Public proof-of-concept exploits for fresh CVEs, tracked from GitHub around the clock. Filter, search and stay ahead of attackers.
monitoring live11117 results
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.
CVE-2026-88773
Fetching description from NVD…
A WordPress plugin exposing an MCP server over the REST API, with the security model as the point -- closes the CVE-2026-15015 OAuth-bypass shape by never havi…
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the push queue by the mail-to-push feature, and use those URLs to take over the targeted accounts. This exploit chain requires the plugin's mail-to-push feature (wpmobile_auto_mail=1) to be enabled, as that setting is what causes outbound WordPress password-reset emails — including the reset URL and key — to be mirrored into the push row queue where they become accessible to the attacker.
Defensive analysis, detection scanner, and rule signatures for CVE-2026-94541 (WPMobile.App <= 11.82).
Fetching description from NVD…
CVE-2026-103931
Fetching description from NVD…
Research & PoC for CVE-2024-54767 and related unauthenticated FRITZ!OS information-disclosure findings across multiple FRITZ!Box models and firmware versions.
Fetching description from NVD…
A comprehensive all-in-one Python-based Proof of Concept script to discover and exploit a critical authentication bypass vulnerability (CVE-2024-55591) in cert…
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS and FortiProxy may allow a remote attacker to gain super-…
Educational implementation in Go for CVE-2024-55591 (Fortinet FortiOS Authentication Bypass). Designed for security research, vulnerability assessment, and und…
Fetching description from NVD…
Exploitability PoC for CVE-2026-102-268 (PyJWT Asymmetric-PEM detection bypass).
Fetching description from NVD…
CVE-2026-104826: path traversal to RCE in DropzoneFileExplorer chunked upload handler
Fetching description from NVD…
CVE-2026-103978: unauthenticated path traversal (arbitrary .json read) in OPNMGR
Fetching description from NVD…
Unauthenticated RCE in Yamcs mission control via YAML injection in reconfigureInstance()
Fetching description from NVD…
Penpot <2.15.0 allows for unathenticated RCE CVE-2026-45805
Fetching description from NVD…
利用CVE-2025-45737漏洞，实现提权
Fetching description from NVD…
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
Fetching description from NVD…
CVE-2025-24801 Exploit
Fetching description from NVD…
The PoC of CVE-2026-44011: Craft CMS RCE with an authenticated user.
CVE-2026-44011-craft-rce-poc
Craft CMS CVE-2026-44011 condition FieldLayout RCE PoC
Authenticated Craft CMS RCE PoC for CVE-2026-44011
This is a PoC of the CVE-2026-44011 found by precicom-vincent-tl. For more details check: https://github.com/advisories/GHSA-qrgm-p9w5-rrfw
Fetching description from NVD…
CVE-2026-63292
Fetching description from NVD…
CVE-2026-57973 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Microsoft Windows Subsystem for Linux (WSL2) that allows an autho…
Fetching description from NVD…
PoC for CVE-2026-14378: DevKit Pro ≤2.3.0 unauthenticated admin takeover via original_user_id cookie + revert_switch nonce. check/admin + mass scan.
Defensive analysis, patch breakdown, and detection scanner for CVE-2026-14378 (WordPress DevKit Pro Plugin <= 2.3.0).
Fetching description from NVD…
Defensive analysis, patch breakdown, and passive detection scanner for CVE-2026-103752 (WordPress Authorizer Plugin <= 3.15.3).
Fetching description from NVD…
RF-14310 / CVE-2018-12533 - Payload generator
Simplest and most reliable RichFaces Paint2DResource CVE-2018-12533 RF-14310 exploit PoC
Deliberately vulnerable CTF lab reproducing CVE-2018-12533 (RichFaces Paint2DResource EL injection) end to end.
Fetching description from NVD…
Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php
Fetching description from NVD…
Session-scoped TOTP rate limiting permits repeated verification attempts
Fetching description from NVD…
POC for libapache2-mod-security2
Fetching description from NVD…
FragAttacks WiFi penetration framework — CVE-2020-24586/87/88
Fetching description from NVD…
Sources: public PoC repositories on GitHub (nomi-sec/PoC-in-GitHub), descriptions and scores from NVD / CVE.org. Exploit code is third-party; review before running.