Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,526cataloged exploits
34,478CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,534GitHub PoC 13,654VulnCheck XDB 8,213Nuclei 4,218Metasploit 3,464✓ verified onlyrecentpopularrisk
21,534 exploits
Referência
CVE-2026-5826
CVE-2026-5826MEDIUM
code-projects Simple IT Discussion Forum edit-category.php cross site scripting
33RISK
open ↗
Referência✓ VexDay Proof
PowerNews 2.5.6 - Local File Inclusion
CVE-2008-0742—webappsphp
Multiple directory traversal vulnerabilities in PowerScripts PowerNews 2.5.6 allow remote attackers to read and include
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component com_gallery - SQL Injection
CVE-2008-0746—webappsphp
SQL injection vulnerability in index.php in the Gallery (com_gallery) component for Mambo and Joomla! allows remote atta
23RISK
open ↗
Referência
CVE-2026-5705
CVE-2026-5705MEDIUM
code-projects Online Hotel Booking Booking Endpoint booknow.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-5691
CVE-2026-5691MEDIUM
Totolink A7100RU cstecgi.cgi setFirewallType os command injection
33RISK
open ↗
Referência
CVE-2026-5690
CVE-2026-5690MEDIUM
Totolink A7100RU cstecgi.cgi setRemoteCfg os command injection
33RISK
open ↗
Referência
CVE-2026-5689
CVE-2026-5689MEDIUM
Totolink A7100RU cstecgi.cgi setNtpCfg os command injection
33RISK
open ↗
Referência
CVE-2026-5688
CVE-2026-5688MEDIUM
Totolink A7100RU cstecgi.cgi setDdnsCfg os command injection
33RISK
open ↗
Referência
CVE-2026-5687
CVE-2026-5687HIGH
Tenda CX12L NatStaticSetting fromNatStaticSetting stack-based overflow
41RISK
open ↗
Referência
CVE-2026-5686
CVE-2026-5686HIGH
Tenda CX12L RouteStatic fromRouteStatic stack-based overflow
41RISK
open ↗
Referência
CVE-2026-5685
CVE-2026-5685HIGH
Tenda CX12L addressNat fromAddressNat stack-based overflow
41RISK
open ↗
Referência
CVE-2026-5684
CVE-2026-5684HIGH
Tenda CX12L webExcptypemanFilter fromwebExcptypemanFilter stack-based overflow
41RISK
open ↗
Referência
CVE-2026-5683
CVE-2026-5683MEDIUM
Tenda CX12L P2pListFilter fromP2pListFilter stack-based overflow
33RISK
open ↗
Referência
CVE-2026-5682
CVE-2026-5682MEDIUM
Meesho Online Shopping App com.meesho.supply endpoint risky encryption
33RISK
open ↗
Referência
CVE-2026-5681
CVE-2026-5681MEDIUM
itsourcecode sanitize or validate this input Parameter borrowedequip.php sql injection
33RISK
open ↗
Referência
CVE-2026-5679
CVE-2026-5679MEDIUM
Totolink A3300R cstecgi.cgi vsetTr069Cfg os command injection
33RISK
open ↗
Referência
CVE-2026-5678
CVE-2026-5678MEDIUM
Totolink A7100RU cstecgi.cgi setScheduleCfg os command injection
33RISK
open ↗
Referência
CVE-2026-5677
CVE-2026-5677MEDIUM
Totolink A7100RU cstecgi.cgi CsteSystem os command injection
33RISK
open ↗
Referência
CVE-2026-5676
CVE-2026-5676MEDIUM
Totolink A8000R cstecgi.cgi setLanguageCfg missing authentication
33RISK
open ↗
Referência
CVE-2026-5675
CVE-2026-5675MEDIUM
itsourcecode Construction Management System Parameter borrowed_tool.php sql injection
33RISK
open ↗
Referência
CVE-2026-5672
CVE-2026-5672MEDIUM
code-projects Simple IT Discussion Forum Parameter edit-category.php sql injection
33RISK
open ↗
Referência
CVE-2026-5671
CVE-2026-5671MEDIUM
Cyber-III Student-Management-System Class Schedule Deletion Endpoint delete_batch.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-5670
CVE-2026-5670MEDIUM
Cyber-III Student-Management-System upload.php move_uploaded_file unrestricted upload
33RISK
open ↗
Referência
CVE-2026-5330
CVE-2026-5330MEDIUM
SourceCodester/mayuri_k Best Courier Management System User Delete ajax.php access control
33RISK
open ↗
Referência
CVE-2026-5328
CVE-2026-5328MEDIUM
shsuishang modulithshop ProductItemDao ProductIndexServiceImpl.java listItem sql injection
33RISK
open ↗
Referência
CVE-2026-5327
CVE-2026-5327MEDIUM
efforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injection
33RISK
open ↗
Referência
CVE-2026-5326
CVE-2026-5326MEDIUM
SourceCodester Leave Application System User Information index.php authorization
33RISK
open ↗
Referência
CVE-2026-5325
CVE-2026-5325MEDIUM
SourceCodester Simple Customer Relationship Management System Create Ticket create-ticket.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-5259
CVE-2026-5259MEDIUM
AutohomeCorp frostmourne Alarm Preview AlarmController.java server-side request forgery
33RISK
open ↗
Referência
CVE-2026-5258
CVE-2026-5258MEDIUM
Sanster IOPaint File Manager file_manager.py _get_file path traversal
33RISK
open ↗
← previouspage 180 / 718next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.