Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,679cataloged exploits
40,329CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,150 exploits
Referência✓ VexDay Proof
Collabtive 0.4.8 - Cross-Site Scripting / Authentication Bypass / Arbitrary File Upload
CVE-2008-6947—webappsphp
Collabtive 0.4.8 allows remote attackers to bypass authentication and create new users, including administrators, via un
23RISK
open ↗
Referência
CVE-2009-4785
CVE-2009-4785—
SQL injection vulnerability in the Quick News (com_quicknews) component for Joomla! allows remote attackers to execute a
23RISK
open ↗
Referência
CVE-2014-6332
CVE-2014-6332HIGHunder attack
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISK
open ↗
Referência
CVE-2026-7292
CVE-2026-7292MEDIUM
o2oa NodeAgent NodeAgent.java syncFile improper authorization
33RISK
open ↗
Referência
CVE-2026-7290
CVE-2026-7290MEDIUM
JeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil sql injection
33RISK
open ↗
Referência
CVE-2026-7289
CVE-2026-7289HIGH
D-Link DIR-825M formWanConfigSetup sub_414BA8 buffer overflow
41RISK
open ↗
Referência
CVE-2022-35405
CVE-2022-35405CRITICALunder attack
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code
100RISK
open ↗
Referência
CVE-2014-6332
CVE-2014-6332HIGHunder attack
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISK
open ↗
Referência
CVE-2014-9613
CVE-2014-9613—
Multiple SQL injection vulnerabilities in Netsweeper before 2.6.29.10 allow remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência
CVE-2026-61517
CVE-2026-61517HIGH
Netis NX10 OS Command Injection via Ping Diagnostic Handler
41RISK
open ↗
Referência
CVE-2026-84425
CVE-2026-84425MEDIUM
zhayujie CowAgent Browser Tool browser_tool.py BrowserTool denial of service
33RISK
open ↗
Referência
CVE-2026-61516
CVE-2026-61516CRITICAL
Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint
48RISK
open ↗
Referência✓ VexDay Proof
Collabtive 0.4.8 - Cross-Site Scripting / Authentication Bypass / Arbitrary File Upload
CVE-2008-6948—webappsphp
Unrestricted file upload vulnerability in Collabtive 0.4.8 allows remote authenticated users to execute arbitrary code b
23RISK
open ↗
Referência
CVE-2026-7288
CVE-2026-7288HIGH
D-Link DIR-825M formVpnConfigSetup sub_4151FC buffer overflow
41RISK
open ↗
Referência
CVE-2026-7283
CVE-2026-7283MEDIUM
SourceCodester Pharmacy Sales and Inventory System ajax.php save_expired sql injection
33RISK
open ↗
Referência
CVE-2026-27760
CVE-2026-27760CRITICAL
OpenCATS PHP Code Injection via installer AJAX endpoint
75RISK
open ↗
Referência
CVE-2026-7282
CVE-2026-7282MEDIUM
SourceCodester Pharmacy Sales and Inventory System ajax.php delete_expired sql injection
33RISK
open ↗
Referência
CVE-2026-7281
CVE-2026-7281MEDIUM
SourceCodester Pharmacy Sales and Inventory System index.php supplier cross site scripting
33RISK
open ↗
Referência
CVE-2026-7272
CVE-2026-7272MEDIUM
WilliamCloudQi matlab-mcp-server MCP index.ts execute_matlab_code path traversal
33RISK
open ↗
Referência
CVE-2026-7271
CVE-2026-7271MEDIUM
DV0x creative-ad-agent creative-ad-agent-server sdk-server.ts path traversal
33RISK
open ↗
Referência
CVE-2026-7269
CVE-2026-7269MEDIUM
SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-7268
CVE-2026-7268MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php save_category sql injection
33RISK
open ↗
Referência
CVE-2026-7267
CVE-2026-7267MEDIUM
SourceCodester Pizzafy Ecommerce System view_prod.php sql injection
33RISK
open ↗
Referência
CVE-2026-7266
CVE-2026-7266MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php save_order sql injection
33RISK
open ↗
Referência
CVE-2026-7265
CVE-2026-7265MEDIUM
SourceCodester Pizzafy Ecommerce System index.php category sql injection
33RISK
open ↗
Referência
CVE-2026-7264
CVE-2026-7264MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php get_cart_items sql injection
33RISK
open ↗
Referência
CVE-2026-7248
CVE-2026-7248CRITICAL
D-Link DI-8100 CGI Endpoint tgfile.htm tgfile_htm buffer overflow
48RISK
open ↗
Referência
CVE-2026-7247
CVE-2026-7247HIGH
D-Link DI-8100 File Extension file_exten.asp file_exten_asp buffer overflow
41RISK
open ↗
Referência
CVE-2026-7244
CVE-2026-7244CRITICAL
Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection
48RISK
open ↗
Referência
CVE-2026-7243
CVE-2026-7243CRITICAL
Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection
48RISK
open ↗
← previouspage 261 / 872next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.