Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,388cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,990Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
26,070 exploits
Referência
CVE-2026-86277
CVE-2026-86277MEDIUM
SourceCodester Syllabus-Aligned Learning Management & Examination System delete_exam.php authorization
33RISK
open ↗
Referência
CVE-2026-86273
CVE-2026-86273MEDIUM
projeto-siga HTML-to-PDF Endpoint ExUtilController.java DownloadExterno.getUrl server-side request forgery
33RISK
open ↗
Referência
CVE-2024-3273
CVE-2024-3273HIGHunder attack
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection
100RISK
open ↗
Referência
CVE-2026-16950
CVE-2026-16950HIGH
Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_products
41RISK
open ↗
Referência
CVE-2026-76989
CVE-2026-76989MEDIUM
liftoff-sr CIPster TCP Encapsulation Receive Path encap.cc out-of-bounds
33RISK
open ↗
Referência
CVE-2012-4267
CVE-2012-4267—
Cross-site scripting (XSS) vulnerability in user/register in Sockso 1.5 and earlier allows remote attackers to inject ar
23RISK
open ↗
Referência
CVE-2026-16617
CVE-2026-16617HIGH
Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description
41RISK
open ↗
Referência
CVE-2014-6038
CVE-2014-6038—
Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerabili
60RISK
open ↗
Referência
CVE-2026-12518
CVE-2026-12518HIGH
Local privilege escalation in the Logi Options+ updater service on Windows
41RISK
open ↗
Referência
CVE-2026-90605
CVE-2026-90605CRITICAL
Totolink A3002MU boa formFilter buffer overflow
48RISK
open ↗
Referência
CVE-2026-86261
CVE-2026-86261MEDIUM
sfturing hosp_order Order Controller OrderController.java authorization
33RISK
open ↗
Referência
CVE-2026-86245
CVE-2026-86245MEDIUM
itsourcecode Sales and Inventory System sup_transac.php sql injection
33RISK
open ↗
Referência
CVE-2026-86244
CVE-2026-86244MEDIUM
FastAdmin User Controller User.php login cross site scripting
33RISK
open ↗
Referência✓ VexDay Proof
RealPlayer 11 - '.au' Denial of Service
CVE-2007-6235—doswindows
A certain ActiveX control in RealNetworks RealPlayer 11 allows remote attackers to cause a denial of service (applicatio
23RISK
open ↗
Referência
CVE-2012-4865
CVE-2012-4865—
Buffer overflow in Oreans Themida 2.1.8.0 allows remote attackers to execute arbitrary code via a crafted .TMD file.
23RISK
open ↗
Referência
CVE-2026-19827
CVE-2026-19827MEDIUM
alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputStream path traversal
33RISK
open ↗
Referência✓ VexDay Proof
PIGMy-SQL 1.4.1 - 'getdata.php' Blind SQL Injection
CVE-2008-1870—webappsphp
SQL injection vulnerability in getdata.php in PIGMy-SQL 1.4.1 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência
CVE-2009-4624
CVE-2009-4624—
SQL injection vulnerability in download.php in Nicecoder iDesk allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2018-11776
CVE-2018-11776HIGHunder attack
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RISK
open ↗
Referência
CVE-2018-7600
CVE-2018-7600CRITICALunder attackransomware
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
open ↗
Referência
CVE-2018-7600
CVE-2018-7600CRITICALunder attackransomware
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
open ↗
Referência
CVE-2026-19899
CVE-2026-19899MEDIUM
SourceCodester Class and Exam Timetabling System edit_teacher.php sql injection
33RISK
open ↗
Referência
CVE-2020-8515
CVE-2020-8515CRITICALunder attack
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow
100RISK
open ↗
Referência✓ VexDay Proof
plxAutoReminder 3.7 - 'id' SQL Injection
CVE-2009-0593—webappsphp
SQL injection vulnerability in members.php in plx Auto Reminder 3.7 allows remote authenticated users to execute arbitra
23RISK
open ↗
Referência
CVE-2026-19826
CVE-2026-19826MEDIUM
alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserialization
33RISK
open ↗
Referência
CVE-2026-19895
CVE-2026-19895MEDIUM
opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication
33RISK
open ↗
Referência✓ VexDay Proof
phpskelsite 1.4 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
CVE-2009-0594—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in phpSkelSite 1.4 allows remote attackers to inject arbitrary web
23RISK
open ↗
Referência
CVE-2012-5324
CVE-2012-5324—
Multiple buffer overflows in the Pdf Printer Preferences ActiveX Control in pdfxctrl.dll in Tracker Software PDF-XChange
23RISK
open ↗
Referência
CVE-2026-17017
CVE-2026-17017HIGH
CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation
41RISK
open ↗
Referência✓ VexDay Proof
Vantage Linguistics AnswerWorks 4 - API ActiveX Control Buffer Overflow
CVE-2007-6387—remotewindows
Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Van
35RISK
open ↗
← previouspage 189 / 869next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.