Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,679cataloged exploits
40,329CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,150 exploits
Referência
CVE-2026-83533
CVE-2026-83533MEDIUM
WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment
33RISK
open ↗
Referência
CVE-2026-13487
CVE-2026-13487MEDIUM
SourceCodester Class and Exam Timetabling System archive.php sql injection
33RISK
open ↗
Referência
CVE-2026-5776
CVE-2026-5776MEDIUM
Email Encoder < 2.4.7 - Unauthenticated Stored XSS
33RISK
open ↗
Referência
CVE-2009-2882
CVE-2009-2882—
Multiple cross-site scripting (XSS) vulnerabilities in PG MatchMaking allow remote attackers to inject arbitrary web scr
23RISK
open ↗
Referência
CVE-2010-0319
CVE-2010-0319—
Cross-site scripting (XSS) vulnerability in index.php in Docmint 1.0 and 2.1 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2015-7562
CVE-2015-7562—
Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbi
23RISK
open ↗
Referência✓ VexDay Proof
PHP 5.2.3 - 'PHP_gd2.dll' imagepsloadfont Local Buffer Overflow (PoC)
CVE-2007-4033—doswindows
Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent at
28RISK
open ↗
Referência
CVE-2008-6924
CVE-2008-6924—
Multiple cross-site scripting (XSS) vulnerabilities in register.php in eSyndiCat Directory 2.2 allow remote attackers to
23RISK
open ↗
Referência
CVE-2009-4464
CVE-2009-4464—
Cross-site scripting (XSS) vulnerability in searchadvance.asp in Active Business Directory 2 allows remote attackers to
23RISK
open ↗
Referência
CVE-2009-4684
CVE-2009-4684—
Cross-site scripting (XSS) vulnerability in index.php in EZodiak allows remote attackers to inject arbitrary web script
23RISK
open ↗
Referência
CVE-2026-8385
CVE-2026-8385MEDIUM
WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback
48RISK
open ↗
Referência
CVE-2026-12216
CVE-2026-12216MEDIUM
svaarala duktape duk_api_bytecode.c memory corruption
33RISK
open ↗
Referência
CVE-2010-2156
CVE-2010-2156—
ISC DHCP 4.1 before 4.1.1-P1 and 4.0 before 4.0.2-P1 allows remote attackers to cause a denial of service (server exit)
60RISK
open ↗
Referência
CVE-2009-2884
CVE-2009-2884—
Cross-site scripting (XSS) vulnerability in bios.php in PHP Scripts Now World's Tallest Buildings allows remote attacker
23RISK
open ↗
Referência
CVE-2009-3187
CVE-2009-3187—
Cross-site scripting (XSS) vulnerability in gamelist.php in Stand Alone Arcade 1.1 allows remote attackers to inject arb
23RISK
open ↗
Referência
CVE-2021-47956
CVE-2021-47956HIGH
EgavilanMedia PHPCRUD 1.0 SQL Injection via firstname
41RISK
open ↗
Referência
CVE-2020-37242
CVE-2020-37242HIGH
WordPress Plugin Supsystic Ultimate Maps 1.1.12 SQL Injection via sidx
41RISK
open ↗
Referência
CVE-2026-12214
CVE-2026-12214HIGH
Qihoo 360 Total Security Nucleus Engine Monitoring Logic RpcStringBindingComposeW protection mechanism
41RISK
open ↗
Referência
CVE-2026-71195
CVE-2026-71195CRITICAL
In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns th
48RISK
open ↗
Referência✓ VexDay Proof
Seditio CMS 121 - 'pfs.php' Arbitrary File Upload
CVE-2007-4057—webappsphp
Unrestricted file upload vulnerability in pfs.php in Neocrome Seditio 121 and earlier allows remote authenticated users
23RISK
open ↗
Referência
CVE-2026-113741
CVE-2026-113741MEDIUM
itsourcecode Online Cake Ordering System 404.php cross site scripting
33RISK
open ↗
Referência
CVE-2024-25413
CVE-2024-25413CRITICAL
A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 all
48RISK
open ↗
Referência
CVE-2026-82693
CVE-2026-82693CRITICAL
Tenda AC1206 Web UI telnet TendaTelnet missing authentication
48RISK
open ↗
Referência
CVE-2009-4359
CVE-2009-4359—
Cross-site scripting (XSS) vulnerability in folder.php in the SmartMedia 0.85 Beta module for XOOPS allows remote attack
23RISK
open ↗
Referência
CVE-2026-90488
CVE-2026-90488MEDIUM
Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection
33RISK
open ↗
Referência
CVE-2026-82668
CVE-2026-82668MEDIUM
klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection
33RISK
open ↗
Referência
CVE-2011-10013
CVE-2011-10013CRITICAL
Traq 2.0–2.3 admincp/common.php RCE
63RISK
open ↗
Referência
CVE-2011-10013
CVE-2011-10013CRITICAL
Traq 2.0–2.3 admincp/common.php RCE
63RISK
open ↗
Referência
CVE-2011-10013
CVE-2011-10013CRITICAL
Traq 2.0–2.3 admincp/common.php RCE
63RISK
open ↗
Referência
CVE-2009-2332
CVE-2009-2332—
CMS Chainuk 1.2 and earlier allows remote attackers to obtain sensitive information via (1) a crafted id parameter to in
23RISK
open ↗
← previouspage 258 / 872next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.