Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
pocindex — Search 82,000+ public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub. | Kitploit
Tools/GitHubGitHub/0xmarcio/pocindex
OSINT (Open Source Intelligence)Vulnerability ScannersExploit FrameworksVulnerability AnalysisExploitationInformation GatheringThreat IntelligenceCurated Resources
GitHub0xmarcio/pocindex

pocindex

Search 82,000+ public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub.

View Repository
1.4k169858 days agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
Website

PoC Index

last sync CI CVEs with PoCs known exploited stars

Search PoC Index

Just landed

Trending in 2026

Trending in 2025

2024, 2023

Trending in 2024

Data

Every file is plain JSON on the CDN. No key, no rate limit.

root@kitploit:~
# everything the index knows about one CVE
curl -s https://pocindex.io/CVE_list.json \
  | jq '.[] | select(.cve == "CVE-2021-44228") | {cve, poc: (.poc | length), nuclei, msf, edb, vulhub, collections}'

# every published CVSS assessment plus vetted advisory links
curl -s https://pocindex.io/cve_metadata.json | jq '."CVE-2021-44228"'

# likelihood of exploitation in the next 30 days
curl -s https://pocindex.io/epss.json | jq '."CVE-2021-44228"'

# stars and last push for one PoC repository; repository keys are lowercased
curl -s https://pocindex.io/repo_meta.json | jq '."sfewer-r7/cve-2026-55040"'

What CISA says is being exploited, that also has a PoC here, ranked by how likely each is to be used next:

root@kitploit:~
curl -s https://pocindex.io/kev.json  -o kev.json
curl -s https://pocindex.io/epss.json -o epss.json
jq -n --slurpfile kev kev.json --slurpfile epss epss.json \
  '[$kev[0] | keys[] | select($epss[0][.]) | {cve: ., epss: $epss[0][.][0]}]
   | sort_by(-.epss) | .[:10]'

CVSS rows are [version, score, severity, vector, source, assessment type]. Advisory rows are [URL, NVD reference tags].

Sources

Build

Contributing

Missing PoC, wrong link, dead repository: open an issue with the CVE id and the repository URL.

Download Tool
StarsUpdatedRepositoryDescription
0⭐3h agoKEV Langflow-RCE-CVE-2025-3248Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A…
1⭐7h agoCVE-2026-32996A vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.
2⭐7h agoPOC-AIOWPM-CVE-2026-19949PoC funcional de CVE-2026-19949 (AIOWPM): SQLi de segundo orden no autenticada en All-in-One WP Migration <=…
0⭐12h agoKEV CVE-2025-24813Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure…
0⭐21h agoCVE-2025-64512_PoCPdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from…
0⭐1d agoCVE-2026-69328Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.
0⭐1d agoKEV CVE-2025-32432Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond.…
0⭐2d agoCVE-2025-24071Dependency-free PoC generator for CVE-2025-24071 - Windows File Explorer .library-ms NTLM hash disclosure via…
0⭐2d agoKEV CVE-2025-38352-PoCPoC and GDB script assists in triggering CVE-2025-38352
2⭐3d agoCVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker…
StarsUpdatedRepositoryDescription
17⭐1d agoCVE-2026-31694-POCLinux kernel FUSE readdir cache out-of-bounds write (CVE-2026-31694): a malicious FUSE server overflows a…
4⭐1d agoCVE-2026-18963Keycloak reset-credentials flow bypass
4⭐1d agoKEV CVE-2026-73570Zimbra SNMP Notification OS Command Injection - Unauthenticated RCE via SMTP exploit (Poc)
6⭐2d agoCVE-2026-42536-PoCHeap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and…
3⭐3d agoKEV cve-2026-85706-poc-exploit-gitlabcve-2026-85706-poc-exploit-gitlab
4⭐3d agoCVE-2026-78006-POCPOC for CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code…
4⭐4d agoCVE-2026-89013CVE-2026-89013 Exploit - Authorization bypass in Dolibarr via the hashp parameter, enabling unauthenticated…
5⭐4d agoCVE-2026-89012CVE-2026-89012 Exploit - SQL filter denylist bypass in Dolibarr via case-insensitive SQL column resolution…
8⭐4d agoKEV CVE-2026-85706GitLab CE/EE unauthenticated path traversal (CVE-2026-85706) - PoC
34⭐4d agoKEV cve-2026-85706Exploit poc for CVE-2026-85706 an unauthenticated arbitrary file read on Gitlab CE-EE affecting versions:…
28⭐4d agoCVE-2026-54121-PoC-Exploit👻 CVE-2026-54121 - Best CertiGhost AD CS Multi-Exploit Framework / Advanced toolkit with rogue DC/LDAP…
6⭐4d agoKEV CVE-2026-24061-PoC-Exploit🚀 CVE-2026-24061 - GNU inetutils-telnetd Auth Bypass Exploit - Full Control 💥 CRLF injection via NEW_ENVIRON…
3⭐6d agoCVE-2026-11387-WooCommerce-SMS-OTPSMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress; SMS Alert…
5⭐7d agoCVE-2026-19089-WooCommerce-TycheCVE-2026-19089 WooCommerce Tych Remote Command Execution
824⭐8d agoKEV CVE-2026-24061CVE-2026-24061 exploit PoC
532⭐8d agoKEV cve-2026-41940-PoCA cPanel and WHM authentication bypassing tool
38⭐8d agoCVE-2026-28576-pocSQL injection vulnerability in Android 17 (AOSP)
4⭐9d agoKEV CVE-2026-41091-PoC-ExploitCVE-2026-41091 RedSun / Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\SYSTEM 🔥 via…
3⭐10d agoCVE-2026-1529-Keycloak-Exploit-ToolKeycloak: Unauthorized organization registration via improper invitation token validation
13⭐10d agoxiaomi15-dada-cve-2026-64560Device-bound CVE-2026-64560 adaptation for Xiaomi 15 dada OS4.0.0.8
StarsUpdatedRepositoryDescription
3⭐19d agoKEV CVE-2025-3248-Langflow-RCELangflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A…
7⭐19d agoKEV vivo_iqoo_neo_9_root_research_on_CVE-2025-21479Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of…
4⭐27d agoKEV cve-2025-21479_iqooneo8Local root exploit for CVE-2025-21479 (Adreno KGSL) on iQOO Neo8 (SM8475) - physical memory r/w, disables…
3⭐29d agoKEV vivo_iqoo_neo_9_root_research_on_CVE-2025-21479iQOO Neo9 (PD2338C) 免解锁 Caps-Root 工具** - 基于 CVE-2025-21479 (Adreno GPU SDS) 的任意物理写提权方案
20⭐36d agoCVE-2025-7771ThrottleStop.sys Arbitrary Physical Memory R/W
6⭐40d agoCVE-2025-8045Dirty Pagetable Exploit for CVE-2025-8045
7⭐44d agoKEV SELinux-Permissive-Only-CVE-2025-21479This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the…
4⭐56d agoKEV CVE-2025-32432Exploit, POC for CVE-2025-32432, CraftCMS2Shell
4⭐58d agoCVE-2025-64512CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads
4⭐60d agoKEV CVE-2025-8110-gogs-pocPoC for CVE-2025-8110 - Gogs arbitrary file write via symlink
7⭐69d agoCVE-2025-30065This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It…
4⭐75d agoCVE-2025-69212-PoCOpenSTAManager v2.9.8 and earlier versions contain a critical OS Command Injection vulnerability in the P7M…
3⭐75d agoKEV CVE-2025-57819CVE-2025-57819 - FreePBX Unauthenticated Remote Code Execution (RCE)
4⭐80d agoCVE-2025-69212-PoCOpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and…
5⭐82d agoKEV CVE-2025-8110PoC exploit for CVE-2025-8110
StarsUpdatedRepositoryDescription
17⭐30d agoCVE-2024-56426A PoC of the CVE-2024-56426 vulnerability.
4⭐31d agoCVE-2024-56426CVE-2024-56426 Exynos9830 Bootrom Exploit - SM-G985F
3⭐48d agoCVE-2024-36104-PoCPoC for CVE-2024-36104 - unauthenticated Groovy RCE in Apache OFBiz (<18.12.14) via /%2e/%2e/ view path…
3⭐86d agoCVE-2024-36991Exploit for CVE-2024-36991 , written by me, enumerates a handfull of things, not all, cause not needed.

Trending in 2023

StarsUpdatedRepositoryDescription
3⭐50d agoCVE-2023-52076-PoCPoC exploit for CVE-2023-52076 - zip-slip path traversal in Atril/Xreader (MATE/Cinnamon) enabling arbitrary…
6⭐55d agoCVE-2023-36003PoC for CVE-2023-36003: Windows Exploit Security Feature Bypass Vulnerability in Windows Defender.
3⭐70d agoKEV cve-2023-4911-exploit-optimizedPure C exploit for CVE-2023-4911 (Looney Tunables) - x86_64 & aarch64 implementations. Multi-processing…
15⭐72d agoKEV CVE-2023-32315-EXPLOITA PoC exploit for CVE-2023-32315 - Openfire Authentication Bypass
6⭐88d agoCVE-2023-6019PoC exploit for CVE-2023-6019 - Remote Code Execution via unauthenticated Ray Dashboard Jobs API.
EndpointHolds
CVE_list.jsonEvery CVE with a linked PoC, its description and its poc, nuclei, msf, edb, vulhub and collections links
cve_metadata.jsonNVD CVSS v2.0, v3.0, v3.1 and v4.0 assessments with vectors and vetted advisory links
epss.jsonExploitation probability and percentile, for nearly every CVE indexed
nuclei.jsonTemplate metadata for the CVEs covered by a runnable Nuclei check
kev.jsonCISA known exploited, keyed by CVE id
repo_meta.jsonStars and last push date per PoC repository, keys lowercased
trending_poc.jsonTrending repositories plus index totals
cves/2026/CVE-2026-68138.mdMarkdown copy of one CVE, one directory per year
SourceWhat it contributes
GitHubRepositories naming a CVE, checked for code before they are linked
PoC-in-GitHubHistorical repository candidates, passed through the same code and intent checks
NucleiRunnable templates that exercise the vulnerability
ExploitDBArchived exploits, mapped by their own CVE column
MetasploitModules, best ranked first
VulhubRunnable vulnerable environments and reproduction steps
afrog, Vulnerability, 0day, xrayCVE-specific templates, code and reproduction guides inside multi-CVE repositories
EPSSDaily exploitation probability from FIRST
CISA KEVWhat is being exploited in the wild
NVDCVSS assessments and tagged vendor, third-party, patch and mitigation references
CVE ProgramThe CVE record, publication state and CNA references
JobCadencePicks up
Trending sweephourlyFront-page repositories and prior-hour candidates added to the searchable index
CVE syncdailyNew CVEs, CNA references and recently pushed GitHub repositories for every CVE year
Metadata syncdaily plus weekly full passCVSS, advisories, rejected records and current CISA KEV status
Nuclei syncdailyNew templates and rating changes
Exploit archivesdailyExploitDB, Metasploit and Vulhub mappings
Historical GitHub syncweeklyOlder PoC repositories missed by the recent-push window
Path collection syncweeklyCVE-specific artifacts inside curated multi-CVE repositories
Link auditweeklyRepositories that went dead, dropped from the index