Are the PoCs on this site free to access?

Public PoCs aggregated from GitHub and the security community are freely accessible. AI-generated PoC analyses produced by Shenlong Agent are a Pro / Pro+ premium feature, requiring a paid subscription.

AI PoC Generator & CVE Exploit Database

Q: What is a CVE PoC (Proof of Concept)?

A CVE PoC (Proof of Concept) is a piece of code or technique that demonstrates how a specific vulnerability (CVE) can be exploited. Security researchers and penetration testers use PoCs to verify whether a vulnerability actually exists in a target system and to understand the potential impact.

Q: How does the AI-generated PoC work?

Shenlong Agent analyzes CVE descriptions, references, and patch diffs using a large language model pipeline. It generates a structured technical walk-through including vulnerability root cause, exploitation steps, and mitigation recommendations — covering high-severity CVEs within hours of disclosure.

We aggregate public proof-of-concept (PoC) code from GitHub and the security community, and use a Shenlong Agent (LLM-based) pipeline to generate technical PoC walk-throughs for high-severity CVEs. Public PoCs are free; AI-generated PoCs are a Pro / Pro+ feature. Each entry links back to its source CVE detail page for full context, references, and patches.

Latest POC List

Public POCs are scraped from GitHub / security community. AI Exclusive POCs are generated by Shenlong Agent — paid content.

Shenlong AI Exclusive POCs are paid content. Logged-in users get 3 free unlocks/month; upgrade to Pro for unlimited access. Log in / View plans

CVE-2026-5349Trendnet TEW-657BRM setup.cgi add_apcdb stack-based overflow AI Paid

Qwen3.6-35B-A3B · 30628 chars · 2026-05-07 17:59

Goal Reached Thanks to every supporter — we hit 100%!

AI PoC Generator & CVE Exploit Database

Latest POC List

CVE-2026-5349Trendnet TEW-657BRM setup.cgi add_apcdb stack-based overflow AI Paid

CVE-2026-34828listmonk: Active sessions remain valid after password reset and password change AI Paid

CVE-2026-34577Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check AI Paid

CVE-2026-34524SillyTavern: Path traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data root AI Paid

CVE-2026-34601xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion AI Paid

CVE-2026-28798Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS AI Paid

CVE-2026-35218Budibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command Palette AI Paid

CVE-2026-34581goshs has Auth Bypass via Share Token AI Paid

CVE-2026-34725dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration AI Paid

CVE-2026-34840OneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature Verification AI Paid

CVE-2026-34758OneUptime: Missing Authentication on Notification Endpoints AI Paid

CVE-2026-34745Unauthenticated Path Traversal Arbitrary File Write in /api/uploadChunked/public AI Paid

CVE-2026-34838Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection` AI Paid

CVE-2026-35535Sudo 安全漏洞 AI Paid

CVE-2026-35536Tornado 安全漏洞 AI Paid

CVE-2026-35216Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step AI Paid

CVE-2026-31818Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist AI Paid

CVE-2026-35214Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write AI Paid

CVE-2026-22663prompts.chat Authorization Bypass Information Disclosure AI Paid

CVE-2026-22661prompts.chat Path Traversal via Skill File Handling AI Paid

Frequently Asked Questions