Public proof-of-concept exploits for fresh CVEs, tracked from GitHub around the clock. Filter, search and stay ahead of attackers.
monitoring live11207 results
Fetching description from NVD…
This PoC demonstrates the Remote Code Execution (RCE) vulnerability in Apache Pyfory (versions 0.12.0-0.12.2 and legacy PyFury 0.1.0-0.10.3) due to insecure …
Fetching description from NVD…
OpenPLC Runtime suffers from a persistent denial of service (DoS) vulnerability in the /upload-program-action endpoint.
Fetching description from NVD…
sql injection PoC for CVE-2025-7558. authored by i-Corner
Fetching description from NVD…
Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation
Fetching description from NVD…
CVE-2025-56807: A Stored Cross Site Scripting (XSS) vulnerability was discovered in FairSketch RISE Ultimate Project Manager & CRM (v3.9.4) in the File Manager…
Fetching description from NVD…
TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthenticated Server-Side Re…
Fetching description from NVD…
A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS).
Fetching description from NVD…
AdForest <= 6.0.9 - Authentication Bypass to Admin
Fetching description from NVD…
CVE-2025-6384: Groovy Sandbox Bypass 2 in CrafterCMS
PoC exploit for an authenticated RCE in CrafterCMS via Groovy sandbox bypass (CVE-2025-6384)
Fetching description from NVD…
A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a …
Fetching description from NVD…
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint.
Fetching description from NVD…
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and …
Fetching description from NVD…
Snipe-IT PoC exploit for CVE-2025-59712 and CVE-2025-59713
Fetching description from NVD…
WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin <= 4.5.3 is vulnerable to a medium priority Arbitrary File Upload
Fetching description from NVD…
WordPress Passster Plugin <= 4.2.18 is vulnerable to Cross Site Scripting (XSS)
Fetching description from NVD…
WordPress WP Full Stripe Free Plugin <= 8.2.5 is vulnerable to SQL Injection
Fetching description from NVD…
WordPress License Manager for WooCommerce Plugin <= 3.0.12 is vulnerable to SQL Injection
Fetching description from NVD…
Stored Cross-Site Scripting (XSS) vulnerability affecting the recipe creation functionality in Mealie versions up to 3.0.1.
Fetching description from NVD…
Cross-Site Scripting (XSS) Vulnerability in Fiora Chat Application
Fetching description from NVD…
Null Pointer Dereference in MuPDF , First CVE discovered by me
Fetching description from NVD…
Cross Site Scripting (XSS) Vulnerability in Fiora Chat Application
Fetching description from NVD…
A reflected cross-site scripting vulnerability in OpenWRT v18.06.2
Fetching description from NVD…
This is POC for IOS 0click CVE-2025-43300
CVE-2025-43300: iOS/macOS DNG Image Processing Memory Corruption
This is POC for IOS 0click CVE-2025-43300
Fetching description from NVD…
Username Enumeration in Trivision NC-227WF
Fetching description from NVD…
[CVE-2017-9822] DotNetNuke Cookie Deserialization Remote Code Execution (RCE)
Sources: public PoC repositories on GitHub (nomi-sec/PoC-in-GitHub), descriptions and scores from NVD / CVE.org. Exploit code is third-party; review before running.