[![last sync](https://img.shields.io/badge/last%20sync-23%20Oct%202026%2011%3A12%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610231112)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C973-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C241-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610231112)](https://github.com/0xMarcio/pocindex/stargazers)

**[PoC Index](https://pocindex.io/)**: Search public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub, with CVSS, EPSS and CISA KEV context. Find exploits by CVE, vendor, product or keyword. Compare CVSS severity, EPSS exploitation scores and CISA known-exploited status. ## Just landed | Repo stars | Released | PoC | Description | | --- | --- | --- | --- | | 1⭐ | 1h ago | [php2shell](https://github.com/agrresore/php2shell) | PHP2Shell proof of concept for CVE-2026-109618 and CVE-2026-109619, with Docker labs and build-specific… | | 0⭐ | 1h ago | [CVE-2026-112403](https://github.com/al4n4n/CVE-2026-112403) | CVE-2026-112403: Pillow heap buffer overflow in ImagingJpegDecode via lossless JPEG thumbnail. One POST, 100%… | | 0⭐ | 1h ago | [php2shell](https://github.com/4nuxd/php2shell) | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the… | | 0⭐ | 2h ago | [php2shell-cve-2026-109618](https://github.com/Chr1s-T/php2shell-cve-2026-109618) | PHP2Shell (CVE-2026-109618/109619): mod_php pre-auth heap-corruption RCE - working PoC, non-destructive… | | 0⭐ | 2h ago | [CVE-2026-8933](https://github.com/yifengchen-cc/CVE-2026-8933) | A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used… | | 0⭐ | 2h ago | KEV

[cve-2019-2215-skyworth](https://github.com/xushihushuo-art/cve-2019-2215-skyworth) | Temproot for Skyworth 65G60 / Coocaa 9S60 (Android 8.0, kernel 4.9.44) via CVE-2019-2215 - port notes for the… | | 0⭐ | 5h ago | [php2shell](https://github.com/LeisureLinux/php2shell) | Two PHP session CVEs (CVE-2026-109618, CVE-2026-109619) - reproducible exploits: pure-HTTP ASLR bypass and… | ## Trending in 2026 | Repo stars | Updated | Repository | Description | | --- | --- | --- | --- | | 1038⭐ | 18h ago | [php2shell-bypass-aslr-exp](https://github.com/9bie/php2shell-bypass-aslr-exp/blob/4586f5cc120c82fd468b17469202bac629810ad9/exploit.py) | A php2shell exploit that requires no modifications to the official version, and does not require… | | 476⭐ | 1d ago | [CVE-2026-9830](https://github.com/opaxial/CVE-2026-9830) | CVE-2026-9830 Proof of Concept | | 564⭐ | 2d ago | KEV

[CVE-2026-41940-PoC](https://github.com/sakidekin/CVE-2026-41940-PoC) | cPanel & WHM Authentication Bypass via CVE-2026-41940 explotation | | 120⭐ | 1d ago | [php2shell](https://github.com/syrex1013/php2shell) | CVE-2026-109618/109619 PoC - PHP session.upload_progress heap use-after-free (CVSS 9.2) | | 103⭐ | 2d ago | [php-cve-2026-10961x-lab-poc](https://github.com/dinosn/php-cve-2026-10961x-lab-poc/blob/eb8558b04a1bbbd85d2b3a7a64780ab17cccc951/scripts/reproduce.py) | PHP CVE-2026-109618/109619 - self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie… | | 63⭐ | 1d ago | [PHP2Shell-Full-Chain-Exploit](https://github.com/78ResearchLab/PHP2Shell-Full-Chain-Exploit) | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the… | | 53⭐ | 16h ago | [actual-php2shell](https://github.com/cookiengineer/actual-php2shell) | :robot: NO, There is an easy way to exploit this vulnerability! (vibecoded to prove a point) | | 36⭐ | 1h ago | [portal-root-kiosk-satellite](https://github.com/jxlarrea/portal-root-kiosk-satellite) | Root and provisioning for Meta Portal devices for optimal use with Kiosk Satellite. | | 804⭐ | 72d ago | KEV

[wp2shell-poc](https://github.com/Icex0/wp2shell-poc) | wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain | | 459⭐ | 45d ago | [Root-My-Pixel](https://github.com/alex193a/Root-My-Pixel) | Jailbreak supported Google Pixel phones with CVE-2026-43499 | | 87⭐ | 4d ago | [root-my-s24](https://github.com/NanoTurtle1145/root-my-s24) | Using CVE-2026-43499 to root your Galaxy S24 Series(SM-S92X0 ,(China / Hong Kong SAR / Taiwan)) | | 44⭐ | 1d ago | [CVE-2026-109618-poc](https://github.com/enactive-systems/CVE-2026-109618-poc) | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the… | | 96⭐ | 10d ago | [IonStack-S22U](https://github.com/sarabpal-dev/IonStack-S22U) | CVE-2026-43499 full exploit chain for Samsung Galaxy S22 Ultra (Android 5.10 kernel) | | 31⭐ | 1d ago | [php-rce](https://github.com/david-alvarez-rosa/php-rce) | Exploits for CVE-2026-109618 / CVE-2026-109619 to achieve RCE on PHP targets | | 16⭐ | 1h ago | [Reversing-Vulnerabilities](https://github.com/jaiswalakshansh/Reversing-Vulnerabilities) | Reversing Vulnerabilities for Fun | | 30⭐ | 17h ago | [cve-2026-109618-php2shell](https://github.com/godylockz/cve-2026-109618-php2shell) | Proof of concept for CVE-2026-109618/CVE-2026-109619: PHP2Shell | | 337⭐ | 87d ago | [CVE-2026-54121](https://github.com/aniqfakhrul/CVE-2026-54121) | Certighost POC | | 60⭐ | 7d ago | [GhostSam](https://github.com/snothin/GhostSam) | Samsung temp root tool (until reboot) - Ghostlock / dirtyfrag exploit chains + manager app. | | 24⭐ | 1d ago | [php2shell-Lab](https://github.com/kuwoo/php2shell-Lab) | 🐘 php2shell（CVE-2026-109618 / CVE-2026-109619）复现靶场 - session.upload_progress 文件名注入 + LFI → RCE，Docker… | ## Trending in 2025 | Repo stars | Updated | Repository | Description | | --- | --- | --- | --- | | 132⭐ | 13h ago | [samsung-tv-root](https://github.com/chris-ritsen/samsung-tv-root) | Samsung QN90B and QN90F root | | 139⭐ | 30d ago | [unisoc-su](https://github.com/Skorpion96/unisoc-su) | A method for CVE-2025-31710 and to connect to cmd_skt to obtain a root shell on unisoc unpatched models | | 245⭐ | 52d ago | [BitUnlocker](https://github.com/garatc/BitUnlocker) | Downgrade attack for CVE-2025-48804 | | 29⭐ | 40d ago | [Douglas-Guidebook](https://github.com/douglasmun/Douglas-Guidebook) | Douglas Mun's Technical Guidebooks | | 22⭐ | 73d ago | [CVE-2025-7771](https://github.com/enessakircolak/CVE-2025-7771) | ThrottleStop.sys Arbitrary Physical Memory R/W | | 7⭐ | 16d ago | KEV

[CVE-2025-32432-exploit-by-P34NUT](https://github.com/P34NUT2/CVE-2025-32432-exploit-by-P34NUT) | Reliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail | | 10⭐ | 57d ago | KEV

[vivo_iqoo_neo_9_root_research_on_CVE-2025-21479](https://github.com/linux-tools/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479) | Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of… | | 6⭐ | 45d ago | [pruva-sandbox](https://github.com/N3mes1s/pruva-sandbox) | Public Codespaces runner for verified CVE/GHSA vulnerability reproductions | | 9⭐ | 82d ago | KEV

[CVE-2025-3248-Langflow-RCE](https://github.com/hideki233/CVE-2025-3248-Langflow-RCE) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | | 3⭐ | 66d ago | KEV

[vivo_iqoo_neo_9_root_research_on_CVE-2025-21479](https://github.com/reaizuguo/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479) | iQOO Neo9 (PD2338C) 免解锁 Caps-Root 工具** - 基于 CVE-2025-21479 (Adreno GPU SDS) 的任意物理写提权方案 |

2024, 2023, 2022

## Trending in 2024 | Repo stars | Updated | Repository | Description | | --- | --- | --- | --- | | 277⭐ | 42d ago | [skill](https://github.com/ptn1411/skill) | Bộ công cụ và tập hợp skill hỗ trợ phân tích phần mềm, khôi phục cấu trúc nguồn ở mức cần thiết, rà soát bảo… | | 68⭐ | 47d ago | KEV

[simple-krw-vuln](https://github.com/cli0xfa/simple-krw-vuln) | Windows 内核任意内存读写漏洞收集仓库，收录简单、稳定、可编译复现的 Exploit（权限提升 / 终止安全软件） | | 17⭐ | 20d ago | [CVE-2024-56426](https://github.com/Creeeeger/CVE-2024-56426) | A PoC of the CVE-2024-56426 vulnerability. | | 5⭐ | 77d ago | [TreeVuln](https://github.com/MaximeBonneton/TreeVuln) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data… | | 4⭐ | 69d ago | [CVE-2024-56426](https://github.com/xcracker000/CVE-2024-56426) | CVE-2024-56426 Exynos9830 Bootrom Exploit - SM-G985F | | 3⭐ | 85d ago | [CVE-2024-36104-PoC](https://github.com/Groppoxx/CVE-2024-36104-PoC) | PoC for CVE-2024-36104 - unauthenticated Groovy RCE in Apache OFBiz (<18.12.14) via /%2e/%2e/ view path… | ## Trending in 2023 | Repo stars | Updated | Repository | Description | | --- | --- | --- | --- | | 155⭐ | 5d ago | KEV

[picohaxx](https://github.com/264312431/picohaxx) | A kernel exploit for Pico 4 devices based on cve-2023-33107. | | 3⭐ | 80d ago | [mouseserver-exploit](https://github.com/lypd0/mouseserver-exploit) | Mobile Mouse 3.6.0.4 - Remote Code Execution - CVE-2023-31902 | | 3⭐ | 88d ago | [CVE-2023-52076-PoC](https://github.com/Groppoxx/CVE-2023-52076-PoC) | PoC exploit for CVE-2023-52076 - zip-slip path traversal in Atril/Xreader (MATE/Cinnamon) enabling arbitrary… | ## Trending in 2022 | Repo stars | Updated | Repository | Description | | --- | --- | --- | --- | | 31⭐ | 81d ago | KEV

[SCRoot](https://github.com/hackintoanetwork/SCRoot) | One-click rooting and KernelSU-Next tool for the Samsung SCR-01 mobile 5G router. | | 8⭐ | 78d ago | [spd_flasher](https://github.com/LeoChen-CoreMind/spd_flasher) | CVE-2022-38694 Hardened Exploit - RP2350 USB Host Auto Flasher for Unisoc devices | | 3⭐ | 79d ago | [realme-c53-unlock-root](https://github.com/Gopartner/realme-c53-unlock-root) | Bootloader unlock (CVE-2022-38694) & root guide for Realme C53 / RMX3760 (Unisoc T612) | | 7⭐ | 14d ago | [CVE-2022-22077](https://github.com/grisuno/CVE-2022-22077) | CVE-2022-22077 is a high-severity vulnerability (CVSS score 7.8) affecting the RTCore64.sys driver… |

## Data Every file is plain JSON on the CDN. No key, no rate limit. ```bash # everything the index knows about one CVE curl -s https://pocindex.io/CVE_list.json \ | jq '.[] | select(.cve == "CVE-2021-44228") | {cve, poc: (.poc | length), nuclei, msf, edb, vulhub, collections}' # every published CVSS assessment plus vetted advisory links curl -s https://pocindex.io/cve_metadata.json | jq '."CVE-2021-44228"' # likelihood of exploitation in the next 30 days curl -s https://pocindex.io/epss.json | jq '."CVE-2021-44228"' # stars and last push for one PoC repository; repository keys are lowercased curl -s https://pocindex.io/repo_meta.json | jq '."sfewer-r7/cve-2026-55040"' ``` What CISA says is being exploited, that also has a PoC here, ranked by how likely each is to be used next: ```bash curl -s https://pocindex.io/kev.json -o kev.json curl -s https://pocindex.io/epss.json -o epss.json jq -n --slurpfile kev kev.json --slurpfile epss epss.json \ '[$kev[0] | keys[] | select($epss[0][.]) | {cve: ., epss: $epss[0][.][0]}] | sort_by(-.epss) | .[:10]' ``` | Endpoint | Holds | | --- | --- | | [`CVE_list.json`](https://pocindex.io/CVE_list.json) | Every CVE with a linked PoC, its description and its `poc`, `nuclei`, `msf`, `edb`, `vulhub` and `collections` links | | [`cve_metadata.json`](https://pocindex.io/cve_metadata.json) | CVSS v2.0, v3.0, v3.1 and v4.0 assessments from NVD and the CVE Program, with vectors and vetted advisory links | | [`epss.json`](https://pocindex.io/epss.json) | Exploitation probability and percentile, for nearly every CVE indexed | | [`nuclei.json`](https://pocindex.io/nuclei.json) | Template metadata for the CVEs covered by a runnable Nuclei check | | [`kev.json`](https://pocindex.io/kev.json) | CISA known exploited, keyed by CVE id | | [`repo_meta.json`](https://pocindex.io/repo_meta.json) | Stars and last push date per PoC repository, keys lowercased | | [`trending_poc.json`](https://pocindex.io/trending_poc.json) | Two independent lists in display order, `landed` by first release and `items` for Trending, plus index totals | | [`cves/2026/CVE-2026-68138.md`](cves/2026/CVE-2026-68138.md) | Markdown copy of one CVE, one directory per year | CVSS rows are `[version, score, severity, vector, source, assessment type]`. Advisory rows are `[URL, NVD reference tags]`. Repository metadata rows are `[stars, last_push_UTC_date]`. Repo stars describe the hosting GitHub repository, including links to individual files. `N/A` means that no public repository reading is available; a measured zero is `0`. `published` is the CVE record publication date. When it is unavailable, `poc_observed` records the earliest retained observation of a listed PoC. Newest uses that fallback and labels it separately as “PoC observed”. ## Sources Public PoCs are indexed as soon as they pass source checks. CVE and NVD metadata enrich the listing when available; pending CVE records do not hide PoC links. | Source | What it contributes | | --- | --- | | GitHub | Repositories naming a CVE, checked for code before they are linked | | [PoC-in-GitHub](https://github.com/nomi-sec/PoC-in-GitHub) | Historical repository candidates, passed through the same code and intent checks | | [Nuclei](https://github.com/projectdiscovery/nuclei-templates) | Runnable templates that exercise the vulnerability | | [ExploitDB](https://gitlab.com/exploit-database/exploitdb) | Archived exploits, mapped by their own CVE column | | [Metasploit](https://github.com/rapid7/metasploit-framework) | Modules, best ranked first | | [Vulhub](https://github.com/vulhub/vulhub) | Runnable vulnerable environments and reproduction steps | | [afrog](https://github.com/zan8in/afrog), [Vulnerability](https://github.com/tzwlhack/Vulnerability), [0day](https://github.com/helloexp/0day), [xray](https://github.com/chaitin/xray), [Google Security Research](https://github.com/google/security-research), [GitHub Security Lab](https://github.com/github/securitylab), [Rhino Security Labs](https://github.com/RhinoSecurityLabs/CVEs), [Tenable](https://github.com/tenable/poc), [pedrib](https://github.com/pedrib/PoC) | CVE-specific templates, code and reproduction guides inside multi-CVE repositories | | [Openwall](https://www.openwall.com/lists/), [SecLists](https://seclists.org/) and [Gist](https://gist.github.com/) | Reproducers from disclosure posts and Gists that NVD references, linked only after review | | [EPSS](https://www.first.org/epss/) | Daily exploitation probability from FIRST | | [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | What is being exploited in the wild | | [NVD](https://nvd.nist.gov/) | CVSS assessments and tagged vendor, third-party, patch and mitigation references | | [CVE Program](https://www.cve.org/) | The CVE record, publication state and CNA references | ## Build | Job | Cadence | Picks up | | --- | --- | --- | | [Trending sweep](.github/workflows/hot_cves.yml) | hourly | Front-page repositories, new repository metadata, a rotating refresh of older repositories and CVE Program scores received during discovery | | [CVE sync](.github/workflows/sync_cve_pocs.yml) | daily | New CVEs, CNA references and recently pushed GitHub repositories for every CVE year | | [Metadata sync](.github/workflows/sync_metadata.yml) | daily plus weekly full pass | CVSS, advisories, rejected records, current CISA KEV status and reviewed Gist and mailing list reproducers | | [Nuclei sync](.github/workflows/sync_nuclei.yml) | daily | New templates and rating changes | | [Exploit archives](.github/workflows/sync_exploits.yml) | daily | ExploitDB, Metasploit and Vulhub mappings | | [Historical GitHub sync](.github/workflows/sync_pocingithub.yml) | daily | Older PoC repositories missed by the recent-push window | | [Path collection sync](.github/workflows/sync_collections.yml) | every 6 hours | CVE-specific artifacts inside curated multi-CVE repositories | | [Link audit](.github/workflows/audit_poc_links.yml) | daily | Repositories that went dead, dropped from the index | ## Contributing Missing PoC, wrong link, dead repository: open an issue with the CVE id and the repository URL.