Public proof-of-concept exploits for fresh CVEs, tracked from GitHub around the clock. Filter, search and stay ahead of attackers.
monitoring live11117 results
Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.
Sanitized WikiLambda report and patch verification notes for CVE-2026-96872.
Fetching description from NVD…
DJI Drone DUML Command Injection over Bluetooth — Proof of Concept for CVE-2026-78306
DJI Drone DUML Command Injection over Bluetooth — Proof of Concept for CVE-2026-78306
Fetching description from NVD…
CVE-2026-85520 PoC (PoCbit) — PrestaShop MyPresta gmfeed ≤2.3.9 unauthenticated arbitrary file write via feed.php (Save to file URL) → RCE. check + exploit + m…
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service
CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints Gateway, build vs 14.1-73.37 / 13.1-64.23, UDP/443 DTLS…
CVE-2026-88772 - Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS)
Fetching description from NVD…
This repo contains a proof-of-concept exploit for CVE-2026-15409. It establishes non-root remote code execution on SonicWall SMA 1000 by implementing the Erlan…
CVE-2026-15409/15410 SonicWall SMA1000 multi-exploit Framework - SSRF→Erlang RPC→RCE→root privesc. Features: --detect safe check, --exec, --read-file, --prives…
CVE-2026-15409
Proof-of-Concept exploit for CVE-2026-15409 (SonicWall SMA 1000 RCE) via Erlang distribution over WebSocket. Achieves unauthenticated remote code execution as …
CVE-2026-15409 - Dectect
Unofficial Bash IoC checker for SonicWall SMA1000 appliances affected by actively exploited CVE-2026-15409 and CVE-2026-15410.
Fetching description from NVD…
CVE-2026-8065 PoC: Hitachi Energy RTU500 unauth firmware update bypass (CWE-306, CVSS 9.1). IoT/OT colored check + mass exploit — RTU500 fingerprint, firmware …
CVE-2026-8065 PoC: Hitachi Energy RTU500 unauth firmware update bypass (CWE-306, CVSS 9.1). IoT/OT colored check + mass exploit — RTU500 fingerprint, firmware …
Fetching description from NVD…
poc for CVE-2024-38063 (RCE in tcpip.sys)
Note: I am not responsible for any bad act. This is written by Chirag Artani to demonstrate the vulnerability.
CVE-2024-38063 is a critical security vulnerability in the Windows TCP/IP stack that allows for remote code execution (RCE)
mitigation script by disabling ipv6 of all interfaces
potential memory corruption vulnerabilities in IPv6 networks.
Windows TCP/IP IPv6(CVE-2024-38063)
Vulnerability CVE-2024-38063
Fetching description from NVD…
s2Member (WordPress) Unauth RCE via SP Tracking Codes eval() + BONUS: incomplete-fix bypass — IPN notify vector still open in 251005..2512xx (fixed only in 2…
Fetching description from NVD…
Proof-of-Concept for CVE-2026-18110
Fetching description from NVD…
CVE-2025-8088 WinRAR Proof of Concept (PoC-Exploit)
Advanced WinRAR Path Traversal Exploit Tool for CVE-2025-8088
A sophisticated GUI tool for creating malicious RAR archives that exploit the WinRAR path traversal vulnerability (CVE-2025-8088) using ADS and RAR5 header man…
WinRAR 0day CVE-2025-8088 PoC RAR Archive
Exploit systems using older WinRAR without knowing their username (unlike other projects)
CVE-2025-8088-BUILDER
An engaging walkthrough on uncovering, patching, and securing the WinRAR CVE-2025-8088 with a hands-on hacker’s twist.
Python tool for safe archive handling, path traversal awareness, and secure extraction. Inspired by CVE-2025-8088.
Fetching description from NVD…
Description: CVE-2024-57521 RuoYi SQL 注入漏洞代码审计、%0b 绕过与自动化 PoC
Fetching description from NVD…
CVE-2026-82901 PoC: WordPress Ultra Addons for Contact Form 7 ≤3.5.50 unauth file upload via signature field when PDF Generator is enabled → wp-content/uploads…
CVE-2026-82901 — Ultra Addons for Contact Form 7 Mass Exploiter (GUI + CLI)
Fetching description from NVD…
simple-git RCE
Fetching description from NVD…
Kestra Unauthenticated RCE
Kestra Auth-Bypass Vulnerability Checker
Fetching description from NVD…
CVE-2025-54136 PoC
A lightweight mcp to prevent poisoning CVE (CVE-2025-54136), researchers hijacking Claude Code/Copilot/Gemini via prompt injection, and hundreds of MCP servers…
Free security-baseline rule for Claude Code, Codex, and Cursor: treats MCP tool descriptions as untrusted input (OWASP MCP Top 10 MCP03, CVE-2025-54136).
Fetching description from NVD…
Benign, self-contained reproduction of CVE-2026-61732 (Decepticon ChatML role-boundary forgery)
Fetching description from NVD…
CVE-2026-10817
Fetching description from NVD…
Published Epson EH-TW5350 CVE · Web Control authentication bypass · B-BEAM-BOB team
Fetching description from NVD…
Published Epson EH-TW5350 CVE · Hard-coded credentials · B-BEAM-BOB team
Fetching description from NVD…
Security advisories for CVE-2021-43716/43717/43718 (Epson EH-TW5350)
Published Epson EH-TW5350 CVE · Firmware update verification bypass · B-BEAM-BOB team
Fetching description from NVD…
Published SiYuan CVE · Reporter: dpfkdlemtp · Official record and advisory links
Fetching description from NVD…
CVE-2026-101894 PoC: @xhmikosr/decompress symlink-chain archive path traversal (bypass CVE-2026-53486). Node lab + lockfile scan + mass evil.tar upload exploit…
Fetching description from NVD…
CVE-2026-101110 PoC: OrdaSoft Joomla Book Library (Free) <=6.4.6 unauth SQLi — field/direction ORDER BY, session prime + `-- xselect` blacklist bypass (com_boo…
Fetching description from NVD…
CVE-2026-101108 PoC: OrdaSoft Joomla Vehicle Manager (Free) <=6.5.7 unauth SQLi — order_field/order_direction unquoted ORDER BY (com_vehiclemanager). Colored c…
Fetching description from NVD…
CVE-2026-100752 PoC: OrdaSoft Joomla Real Estate Manager (Free) <=6.7.8 unauth SQLi via order_field ORDER BY (com_realestatemanager). Colored check + mass expl…
Sources: public PoC repositories on GitHub (nomi-sec/PoC-in-GitHub), descriptions and scores from NVD / CVE.org. Exploit code is third-party; review before running.