Public proof-of-concept exploits for fresh CVEs, tracked from GitHub around the clock. Filter, search and stay ahead of attackers.
monitoring live11151 results
Fetching description from NVD…
CVE-2026-24136 | Lab khai thác lỗ hổng IDOR trên Saleor GraphQL - query order() không kiểm tra xác thực, lộ toàn bộ PII (email, địa chỉ, SĐT) của khách hàng. B…
Fetching description from NVD…
FOSSBilling CVE-2026-53647 & CVE-2026-53646 PoC — Unauthenticated API key disclosure & password reset token reuse
Fetching description from NVD…
CVE-2026-40791: Unauthenticated stored XSS in WP Time Slots Booking Form <= 1.2.46
Fetching description from NVD…
CVE-2024-27983 this repository builds up a vulnerable HTTP2 Node.js server (`server-nossl.js`) based on CVE-2024-27983 which exploits a continuation flood vuln…
Fetching description from NVD…
Publicly disclosed Proof-of-Concept (POC) exploit for the [email protected] version
Fetching description from NVD…
CVE-2026-0273 - Draft
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation via Validation Bypass in all versions up to and including 0.9.2.5. The vulnerability exists due to the after_validate_save_post() function unconditionally trusting the attacker-controlled _acf_post_id POST parameter — with no authentication or integrity verification — to select a cleanup branch that silently discards all validation errors not prefixed with acfe:. This makes it possible for unauthenticated attackers to suppress both the role allow-list validation error added by acfe_field_user_roles::validate_front_value() and the administrator-role capability guard error added by acfe_module_form_action_user::validate_action(), causing wp_insert_user() to execute with an attacker-supplied administrator role argument and resulting in the creation of a new administrator-level user account. Exploitation requires the target site to expose a public ACFE frontend form configured with a Create User action that maps a role field.
Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter
Fetching description from NVD…
Fetching description from NVD…
Fetching description from NVD…
Exploit for command injection vulnerability found in uhttpd binary from TP-Link Tapo c200 IP camera
🔐 "PWNTAPO: Unveiling Command Injection in TP-Link Tapo C200 Cameras (<= v1.1.16 Build 211209)" 🔓
CVE-2021-4045 CVE-2021-4045 is a Command Injection vulnerability that allows Remote Code Execution in the TP-Link Tapo c200 IP camera. It affects all firmware …
TP-Link Tapo c200 ver <1.1.15 - Remote Code Execution (RCE)
Sets up a local Tapo C200 using CVE-2021-4045
Fetching description from NVD…
Hardened dasel v3.3.1 package and image built via Melange and apko. Patching CVE-2026-33320.
dasel v3.3.1 packaged with Melange and shipped as a minimal apko image, patched for CVE-2026-33320
Junior Backend Candidate Exercise: Packaging the dasel CLI (v3.3.1) with Melange, fixing CVE-2026-33320, and building a minimal container image using Apko.
Fetching description from NVD…
PoC de CVE-2026-11645: lectura/escritura fuera de limites en Chrome V8 (CVSS 8.8).
CVE-2026-11645
Fetching description from NVD…
Fetching description from NVD…
LPE exploit for CVE-2023-21768
Using CVE-2023-21768 to manual map kernel mode driver
Windows_AFD_LPE_CVE-2023-21768
cve-2023-21768
CVE-2023-21768 Windows 11 22H2 系统本地提权 POC
C# / .NET version of CVE-2023-21768
Fetching description from NVD…
Fetching description from NVD…
Fetching description from NVD…
CVE-2026-50507 - Draft
Fetching description from NVD…
Advisory for git-js ⌯⌲ 11 mill weekly downloads
Fetching description from NVD…
Lab + writeup for CVE-2026-44166: PocketBase OAuth2 account pre-hijacking via unvalidated createData.email
Fetching description from NVD…
For V8CTF M123
Chrome(CVE-2024-2887)RCE-POC
POC available soon
Fetching description from NVD…
CVE-2026-53767 + CVE-2026-53768 - Authenticated RCE in Chyrp Lite ≤ 2026.01 via uploads_path blocklist bypass and missing extension validation
Fetching description from NVD…
CVE-2024-30085
Exploit en Python diseñado para aprovechar la vulnerabilidad de elevación de privilegios CVE-2024-30085
Fetching description from NVD…
PoC educativo del exploit CVE-2023-4147 (Linux kernel Netfilter UAF) — solo para entornos autorizados
Fetching description from NVD…
The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.
Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload [POC & Xploit]
Sources: public PoC repositories on GitHub (nomi-sec/PoC-in-GitHub), descriptions and scores from NVD / CVE.org. Exploit code is third-party; review before running.