Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
pocindex — Search 82,000+ public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub. | Kitploit
Tools/GitHubGitHub/0xmarcio/pocindex
OSINT (Open Source Intelligence)Vulnerability ScannersExploit FrameworksVulnerability AnalysisExploitationInformation GatheringThreat IntelligenceCurated Resources
GitHub0xmarcio/pocindex

pocindex

Search 82,000+ public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub.

View Repository
1.4k168121 day agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
Website

PoC Index

last sync CI CVEs with PoCs known exploited stars

Search PoC Index

Just landed

Trending in 2026

Trending in 2025

2024, 2023, 2022

Trending in 2024

Data

Every file is plain JSON on the CDN. No key, no rate limit.

root@kitploit:~
# everything the index knows about one CVE
curl -s https://pocindex.io/CVE_list.json \
  | jq '.[] | select(.cve == "CVE-2021-44228") | {cve, poc: (.poc | length), nuclei, msf, edb, vulhub, collections}'

# every published CVSS assessment plus vetted advisory links
curl -s https://pocindex.io/cve_metadata.json | jq '."CVE-2021-44228"'

# likelihood of exploitation in the next 30 days
curl -s https://pocindex.io/epss.json | jq '."CVE-2021-44228"'

# stars and last push for one PoC repository; repository keys are lowercased
curl -s https://pocindex.io/repo_meta.json | jq '."sfewer-r7/cve-2026-55040"'

What CISA says is being exploited, that also has a PoC here, ranked by how likely each is to be used next:

root@kitploit:~
curl -s https://pocindex.io/kev.json  -o kev.json
curl -s https://pocindex.io/epss.json -o epss.json
jq -n --slurpfile kev kev.json --slurpfile epss epss.json \
  '[$kev[0] | keys[] | select($epss[0][.]) | {cve: ., epss: $epss[0][.][0]}]
   | sort_by(-.epss) | .[:10]'

CVSS rows are [version, score, severity, vector, source, assessment type]. Advisory rows are [URL, NVD reference tags].

Sources

Build

Contributing

Missing PoC, wrong link, dead repository: open an issue with the CVE id and the repository URL.

Download Tool
StarsUpdatedRepositoryDescription
0⭐14h agoCVE-2025-39401Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows…
0⭐1d agoCVE-2025-69080Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')…
0⭐1d agoKEV cve-2025-20333A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and…
10⭐2d agoKEV cve-2025-21479-iqoo11proMemory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of…
2⭐2d agoCVE-2026-78904-Digital-Dinar-DrainCBDC Infrastructure Vulnerability Research. CVE-2026-78904: Infinite mint and redemption bypass in central…
0⭐2d agoCVE-2025-6440The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services…
2⭐3d agoCVE-2026-19745Learn how I found my first two CVEs by pure accident.
2⭐3d agoKEV PaperCut-CVE-2026-81578-82078Security research tool for PaperCut CVE-2026-81578 & CVE-2026-82078
0⭐3d agocve-2025-29927Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior…
2⭐5d agoKEV CVE-2025-3248-Langflow-RCELangflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A…
StarsUpdatedRepositoryDescription
10⭐2d agogivewp-cve-2026-82222-rce-labAuthorized Docker lab and clean PoC for validating CVE-2026-82222 RCE in GiveWP 4.16.5.1 and the 4.16.7.2 fix.
18⭐5d agoKEV CVE-2026-72898Metabase SQLi
4⭐5d agoCVE-2026-19478GitLab Code injection
3⭐5d agoKEV CVE-2026-21962Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion…
4⭐6d agoKEV CVE-2026-73570Zimbra SNMP Notification OS Command Injection - Unauthenticated RCE via SMTP exploit (Poc)
81⭐6d agoCVE-2026-75604-pocCVE-2026-75604 Next.js Windows RCE poc
5⭐7d agoKEV CVE-2026-73570A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional…
3⭐7d agoCVE-2026-32475-PoCPoC for CVE-2026-32475: Elementor Pro <=4.2.1 unauthenticated file upload to RCE. Stdlib-only Python.
13⭐7d agoKeycloak_CVE-2026-18963_PoCThis repo is poc of cve-2026-18963. Please use it on legal products (lab, local,...).
19⭐8d agoCVE-2026-18963-keycloakA flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine…
4⭐8d agoCVE-2026-20079Python proof of concept for CVE-2026-20079 affecting Cisco Secure Firewall Management Center.
4⭐10d agoKEV CVE-2026-65400Apple MacOS Screen Sharing Arbitrary File read/write -> RCE
160⭐10d agoCVE-2026-62911POC pre-auth RCE on Exchange
4⭐11d agoKEV CVE-2026-65400-pocRead-only PoC for CVE-2026-65400 - macOS Screen Sharing (screensharingd) pre-auth SRP bypass giving root file…
6⭐11d agoKEV CVE-2026-34910-PoCCVE-2026-34910/34909 - UniFi OS unauth RCE + file read via ..%2f auth bypass (CVSS 10.0, KEV, Mirai ITW)
53⭐11d agoCVE-2026-64638-PoC-XSS2Shell-XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE chain - PoC exploit + defensive audit tool + nuclei…
37⭐12d agoCVE-2026-18963-ExploitExploit for KeyCloak CVE-2026-18963
432⭐12d agoCVE-2026-9830CVE-2026-9830 Proof of Concept
531⭐12d agoKEV cve-2026-41940-PoCA cPanel and WHM authentication bypassing tool
824⭐12d agoKEV CVE-2026-24061CVE-2026-24061 exploit PoC
StarsUpdatedRepositoryDescription
6⭐5d agoKEV vivo_iqoo_neo_9_root_research_on_CVE-2025-21479Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of…
4⭐13d agoKEV cve-2025-21479_iqooneo8Local root exploit for CVE-2025-21479 (Adreno KGSL) on iQOO Neo8 (SM8475) - physical memory r/w, disables…
20⭐22d agoCVE-2025-7771ThrottleStop.sys Arbitrary Physical Memory R/W
6⭐26d agoCVE-2025-8045Dirty Pagetable Exploit for CVE-2025-8045
6⭐30d agoKEV SELinux-Permissive-Only-CVE-2025-21479This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the…
4⭐42d agoKEV CVE-2025-32432Exploit, POC for CVE-2025-32432, CraftCMS2Shell
4⭐44d agoCVE-2025-64512CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads
5⭐46d agoKEV CVE-2025-8110-gogs-pocPoC for CVE-2025-8110 - Gogs arbitrary file write via symlink
7⭐55d agoCVE-2025-30065This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It…
4⭐61d agoCVE-2025-69212-PoCOpenSTAManager v2.9.8 and earlier versions contain a critical OS Command Injection vulnerability in the P7M…
3⭐61d agoKEV CVE-2025-57819CVE-2025-57819 - FreePBX Unauthenticated Remote Code Execution (RCE)
4⭐66d agoCVE-2025-69212-PoCOpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and…
5⭐68d agoKEV CVE-2025-8110PoC exploit for CVE-2025-8110
14⭐81d agovulnerable-nextjs-14-CVE-2025-29927Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior…
14⭐87d agoKEV FreePBX-CVE-2025-57819-RCEFreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable…
7⭐87d agoKEV CVE-2025-57819-pocCVE-2025-57819 -> rce
StarsUpdatedRepositoryDescription
16⭐16d agoCVE-2024-56426A PoC of the CVE-2024-56426 vulnerability.
3⭐17d agoCVE-2024-56426CVE-2024-56426 Exynos9830 Bootrom Exploit - SM-G985F
3⭐34d agoCVE-2024-36104-PoCPoC for CVE-2024-36104 - unauthenticated Groovy RCE in Apache OFBiz (<18.12.14) via /%2e/%2e/ view path…
3⭐72d agoCVE-2024-36991Exploit for CVE-2024-36991 , written by me, enumerates a handfull of things, not all, cause not needed.
7⭐81d agoCVE-2024-27983-nodejs-http2CVE-2024-27983 this repository builds up a vulnerable HTTP2 Node.js server (server-nossl.js) based on…
4⭐87d agoCVE-2024-1065Page Cache Exploit for CVE-2024-1065

Trending in 2023

StarsUpdatedRepositoryDescription
3⭐36d agoCVE-2023-52076-PoCPoC exploit for CVE-2023-52076 - zip-slip path traversal in Atril/Xreader (MATE/Cinnamon) enabling arbitrary…
5⭐41d agoCVE-2023-36003PoC for CVE-2023-36003: Windows Exploit Security Feature Bypass Vulnerability in Windows Defender.
3⭐56d agoKEV cve-2023-4911-exploit-optimizedPure C exploit for CVE-2023-4911 (Looney Tunables) - x86_64 & aarch64 implementations. Multi-processing…
15⭐58d agoKEV CVE-2023-32315-EXPLOITA PoC exploit for CVE-2023-32315 - Openfire Authentication Bypass
6⭐74d agoCVE-2023-6019PoC exploit for CVE-2023-6019 - Remote Code Execution via unauthenticated Ray Dashboard Jobs API.

Trending in 2022

StarsUpdatedRepositoryDescription
6⭐76d agoNimbusPWN-CVE-2022-29799-29800NimbusPwn (CVE-2022-29799/29800) local privilege escalation PoC in C.
EndpointHolds
CVE_list.jsonEvery CVE with a linked PoC, its description and its poc, nuclei, msf, edb, vulhub and collections links
cve_metadata.jsonNVD CVSS v2.0, v3.0, v3.1 and v4.0 assessments with vectors and vetted advisory links
epss.jsonExploitation probability and percentile, for nearly every CVE indexed
nuclei.jsonTemplate metadata for the CVEs covered by a runnable Nuclei check
kev.jsonCISA known exploited, keyed by CVE id
repo_meta.jsonStars and last push date per PoC repository, keys lowercased
trending_poc.jsonTrending repositories plus index totals
cves/2026/CVE-2026-68138.mdMarkdown copy of one CVE, one directory per year
SourceWhat it contributes
GitHubRepositories naming a CVE, checked for code before they are linked
PoC-in-GitHubHistorical repository candidates, passed through the same code and intent checks
NucleiRunnable templates that exercise the vulnerability
ExploitDBArchived exploits, mapped by their own CVE column
MetasploitModules, best ranked first
VulhubRunnable vulnerable environments and reproduction steps
afrog, Vulnerability, 0day, xrayCVE-specific templates, code and reproduction guides inside multi-CVE repositories
EPSSDaily exploitation probability from FIRST
CISA KEVWhat is being exploited in the wild
NVDCVSS assessments and tagged vendor, third-party, patch and mitigation references
CVE ProgramThe CVE record, publication state and CNA references
JobCadencePicks up
Trending sweephourlyFront-page repositories and prior-hour candidates added to the searchable index
CVE syncdailyNew CVEs, CNA references and recently pushed GitHub repositories for every CVE year
Metadata syncdaily plus weekly full passCVSS, advisories, rejected records and current CISA KEV status
Nuclei syncdailyNew templates and rating changes
Exploit archivesdailyExploitDB, Metasploit and Vulhub mappings
Historical GitHub syncweeklyOlder PoC repositories missed by the recent-push window
Path collection syncweeklyCVE-specific artifacts inside curated multi-CVE repositories
Link auditweeklyRepositories that went dead, dropped from the index