Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

26,240 exploits

Referência

CVE-2026-72714 — Rocq Universe Checking State Desynchronised After Module Close

CVE-2026-72714MEDIUM

Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close

33RISK

open ↗

Referência

CVE-2015-2094

CVE-2015-2094—

Stack-based buffer overflow in the WESPPlayback.WESPPlaybackCtrl.1 control in WebGate WinRDS allows remote attackers to

28RISK

open ↗

Referência

CVE-2017-15963

CVE-2017-15963—

iTech Gigs Script 1.21 allows SQL Injection via the browse-scategory.php sc parameter or the service-provider.php ser pa

23RISK

open ↗

Referência✓ VexDay Proof

Linux Kernel 2.6.17 < 2.6.24.1 - 'vmsplice' Local Privilege Escalation (2)

CVE-2008-0600—locallinux

The vmsplice_to_pipe function in Linux kernel 2.6.17 through 2.6.24.1 does not validate a certain userspace pointer befo

23RISK

open ↗

Referência

CVE-2015-2102

CVE-2015-2102—

SQL injection vulnerability in view_item.php in ClipBucket 2.7 RC3 (2.7.0.4.v2929-rc3) allows remote attackers to execut

23RISK

open ↗

Referência

CVE-2017-15976

CVE-2017-15976—

ZeeBuddy 2x allows SQL Injection via the admin/editadgroup.php groupid parameter, a different vulnerability than CVE-200

23RISK

open ↗

Referência

CVE-2017-15986

CVE-2017-15986—

CPA Lead Reward Script allows SQL Injection via the username parameter.

23RISK

open ↗

Referência

CVE-2017-17581

CVE-2017-17581—

FS Quibids Clone 1.0 has SQL Injection via the itechd.php productid parameter.

23RISK

open ↗

Referência

CVE-2017-17583

CVE-2017-17583—

FS Shutterstock Clone 1.0 has SQL Injection via the /Category keywords parameter.

23RISK

open ↗

Referência

CVE-2017-17583

CVE-2017-17583—

FS Shutterstock Clone 1.0 has SQL Injection via the /Category keywords parameter.

23RISK

open ↗

Referência

CVE-2017-17584

CVE-2017-17584—

FS Makemytrip Clone 1.0 has SQL Injection via the show-flight-result.php fl_orig or fl_dest parameter.

23RISK

open ↗

Referência

CVE-2026-108653

CVE-2026-108653MEDIUM

JeecgBoot through 3.9.5 Missing Authorization via GET /openapi/list

33RISK

open ↗

Referência

CVE-2015-5736

CVE-2015-5736—

The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel

23RISK

open ↗

Referência

CVE-2021-34369

CVE-2021-34369—

portlets/contact/ref/refContactDetail.do in Accela Civic Platform through 20.1 allows remote attackers to obtain sensiti

23RISK

open ↗

Referência

CVE-2017-15964

CVE-2017-15964—

Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI.

23RISK

open ↗

Referência

CVE-2026-76071

CVE-2026-76071CRITICAL

Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter

48RISK

open ↗

Referência

CVE-2017-15964

CVE-2017-15964—

Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI.

23RISK

open ↗

Referência

CVE-2026-75089

CVE-2026-75089MEDIUM

PHPGurukul Complaint Management System check_availability.php sql injection

33RISK

open ↗

Referência

CVE-2026-78248

CVE-2026-78248MEDIUM

SourceCodester Simple Online Food Ordering System ajax.php save_settings sql injection

33RISK

open ↗

Referência

CVE-2026-78247

CVE-2026-78247MEDIUM

SourceCodester Simple Online Food Ordering System ajax.php confirm_order sql injection

33RISK

open ↗

Referência

CVE-2026-19995

CVE-2026-19995MEDIUM

Webkul Bagisto RMA Message send-message cross site scripting

33RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Expose RC35 - Arbitrary File Upload

CVE-2007-3932—webappsphp

uploadimg.php in the Expose RC35 and earlier (com_expose) component for Joomla! sends an error message but does not exit

23RISK

open ↗

Referência

CVE-2017-17574

CVE-2017-17574—

FS Care Clone 1.0 has SQL Injection via the searchJob.php jobType or jobFrequency parameter.

23RISK

open ↗

Referência✓ VexDay Proof

bwired - 'index.php?newsID' SQL Injection

CVE-2007-3976—webappsphp

SQL injection vulnerability in index.php in bwired allows remote attackers to execute arbitrary SQL commands via the new

23RISK

open ↗

Referência

CVE-2026-75014

CVE-2026-75014MEDIUM

SourceCodester Pet Grooming Management Software get_barcode_data.php sql injection

33RISK

open ↗

Referência

CVE-2026-78245

CVE-2026-78245MEDIUM

itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload

33RISK

open ↗

Referência

CVE-2026-78244

CVE-2026-78244MEDIUM

itsourcecode Real Estate Management System search.php sql injection

33RISK

open ↗

Referência

CVE-2015-2524

CVE-2015-2524—

Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not proper

23RISK

open ↗

Referência

CVE-2016-0492

CVE-2016-0492—

Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12

60RISK

open ↗

Referência

CVE-2017-15975

CVE-2017-15975—

Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.