Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
26,041 exploits
Referência
Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions
CVE-2023-31468HIGHlocalwindows
An issue was discovered in Inosoft VisiWin 7 through 2022-2.1 (Runtime RT7.3 RC3 20221209.5). The "%PROGRAMFILES(X86)%\I
41RISK
open ↗
Referência
CVE-2010-2124
CVE-2010-2124—
SQL injection vulnerability in firma.php in Bartels Schone ConPresso 4.0.7 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2026-106014
CVE-2026-106014MEDIUM
Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery
33RISK
open ↗
Referência
CVE-2026-89286
CVE-2026-89286MEDIUM
FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File
33RISK
open ↗
Referência
CVE-2026-13524
CVE-2026-13524MEDIUM
CherryHQ cherry-studio MCP OAuth Local Callback Server callback.ts improper authorization
33RISK
open ↗
Referência
CVE-2026-13485
CVE-2026-13485MEDIUM
SourceCodester Class and Exam Timetabling System preview.php sql injection
33RISK
open ↗
Referência
CVE-2026-58049
CVE-2026-58049HIGH
FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()
41RISK
open ↗
Referência✓ VexDay Proof
Telekorn Signkorn Guestbook 1.3 - 'dir_path' Remote File Inclusion
CVE-2006-4788—webappsphp
PHP remote file inclusion vulnerability in includes/log.inc.php in Telekorn SignKorn Guestbook (SL) 1.3 and earlier, whe
23RISK
open ↗
Referência✓ VexDay Proof
Vz (Adp) Forum 2.0.3 - Remote Password Disclosure
CVE-2006-6891—webappsphp
Vz (Adp) Forum 2.0.3 stores sensitive information under the web root with insufficient access control, which allows remo
23RISK
open ↗
Referência
CVE-2010-4839
CVE-2010-4839—
SQL injection vulnerability in the Event Registration plugin 5.32 and earlier for WordPress allows remote attackers to e
23RISK
open ↗
Referência
CVE-2021-21972
CVE-2021-21972CRITICALunder attackransomware
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor
100RISK
open ↗
Referência
CVE-2015-7647
CVE-2015-7647—
Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux all
28RISK
open ↗
Referência
CVE-2026-112081
CVE-2026-112081MEDIUM
hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization
33RISK
open ↗
Referência
CVE-2017-13261
CVE-2017-13261—
In bnep_process_control_packet of bnep_utils.cc, there is a possible out of bounds read due to a missing bounds check. T
23RISK
open ↗
Referência
CVE-2018-7690
CVE-2018-7690MEDIUM
MFSBGN03835 rev.1 - Fortify Software Security Center (SSC), Remote Unauthorized Access
33RISK
open ↗
Referência
CVE-2018-9107
CVE-2018-9107—
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcyMailing exte
23RISK
open ↗
Referência✓ VexDay Proof
Blogator-script 0.95 - 'incl_page' Remote File Inclusion
CVE-2008-1760—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Blogator-script before 1.01 allow remote attackers to execute arbi
23RISK
open ↗
Referência
CVE-2023-31873
CVE-2023-31873HIGH
Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require('child_process').
41RISK
open ↗
Referência
CVE-2015-4127
CVE-2015-4127—
Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers t
38RISK
open ↗
Referência
CVE-2015-4127
CVE-2015-4127—
Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers t
38RISK
open ↗
Referência
CVE-2017-13261
CVE-2017-13261—
In bnep_process_control_packet of bnep_utils.cc, there is a possible out of bounds read due to a missing bounds check. T
23RISK
open ↗
Referência
CVE-2026-112080
CVE-2026-112080MEDIUM
LlamaChinese Llama-Chinese Adapter Config chat_gradio_no_merge.py get_class_from_dynamic_module code injection
33RISK
open ↗
Referência
CVE-2021-21972
CVE-2021-21972CRITICALunder attackransomware
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor
100RISK
open ↗
Referência
CVE-2026-112079
CVE-2026-112079MEDIUM
hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization
33RISK
open ↗
Referência
CVE-2026-103091
CVE-2026-103091CRITICAL
Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)
48RISK
open ↗
Referência✓ VexDay Proof
Quote&Ordering System 1.0 - 'ordernum' Multiple Vulnerabilities
CVE-2006-6911—webappsasp
SQL injection vulnerability in search.asp in Digitizing Quote And Ordering System 1.0 allows remote authenticated users
23RISK
open ↗
Referência✓ VexDay Proof
CMS Creamotion - 'securite.php' Remote File Inclusion
CVE-2007-5298—webappsphp
Multiple PHP remote file inclusion vulnerabilities in CMS Creamotion allow remote attackers to execute arbitrary PHP cod
23RISK
open ↗
Referência
CVE-2015-4075
CVE-2015-4075—
The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted
23RISK
open ↗
Referência✓ VexDay Proof
TeamCalPro 3.1.000 - Multiple Local/Remote File Inclusions
CVE-2007-6554—webappsphp
Multiple directory traversal vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to include and ex
23RISK
open ↗
Referência
CVE-2015-7893
CVE-2015-7893—
SecEmailUI in Samsung Galaxy S6 does not sanitize HTML email content, allows remote attackers to execute arbitrary JavaS
23RISK
open ↗
← previouspage 167 / 869next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.