Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2014-3740
CVE-2014-3740—
Cross-site scripting (XSS) vulnerability in SpiceWorks before 7.2.00195 allows remote authenticated users to inject arbi
23RISK
open ↗
Referência
CVE-2026-58479
CVE-2026-58479CRITICAL
Sustainable Irrigation Platform 5.2.16 RCE via cli_control Plugin Command Injection
48RISK
open ↗
Referência
CVE-2022-0020
CVE-2022-0020MEDIUM
Cortex XSOAR: Stored Cross-Site Scripting (XSS) Vulnerability in Web Interface
33RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência
CVE-2026-12512
CVE-2026-12512HIGH
Quotes Llama < 3.1.6 - Unauthenticated SQL Injection via sc Parameter
41RISK
open ↗
Referência
CVE-2026-15677
CVE-2026-15677MEDIUM
code-projects Online Job Portal JobSeekerInsert.php unrestricted upload
33RISK
open ↗
Referência
CVE-2026-15676
CVE-2026-15676MEDIUM
code-projects Online Job Portal DeleteUser.php sql injection
33RISK
open ↗
Referência
CVE-2017-15081
CVE-2017-15081—
In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.
23RISK
open ↗
Referência
CVE-2017-17562
CVE-2017-17562HIGHunder attack
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. T
100RISK
open ↗
Referência✓ VexDay Proof
Fastpublish CMS 1.6.9 - config[fsBase] Remote File Inclusion
CVE-2006-2726—webappsphp
PHP remote file inclusion vulnerability in Fastpublish CMS 1.6.9.d allows remote attackers to include arbitrary files vi
28RISK
open ↗
Referência
CVE-2019-5420
CVE-2019-5420—
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess th
60RISK
open ↗
Referência✓ VexDay Proof
aspWebLinks 2.0 - SQL Injection / Admin Pass Change
CVE-2006-2847—webappsasp
SQL injection vulnerability in links.asp in aspWebLinks 2.0 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência
CVE-2026-12583
CVE-2026-12583HIGH
Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field
41RISK
open ↗
Referência
CVE-2026-15619
CVE-2026-15619MEDIUM
mosaxiv clawlet IPv4 tool_web_fetch.go web_fetch server-side request forgery
33RISK
open ↗
Referência
CVE-2026-15668
CVE-2026-15668MEDIUM
louisho5 picobot web Tool web.go WebTool.Execute server-side request forgery
33RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência
CVE-2026-13549
CVE-2026-13549MEDIUM
CodeAstro Complaint Management System Report Endpoint Report.php deletereport authorization
33RISK
open ↗
Referência
CVE-2026-13589
CVE-2026-13589MEDIUM
seladb PcapPlusPlus Telnet Subnegotiation Packet TelnetLayer.cpp getSubCommand heap-based overflow
33RISK
open ↗
Referência
CVE-2026-13588
CVE-2026-13588MEDIUM
seladb PcapPlusPlus TLS Hello SSLHandshake.cpp getHandshakeVersion heap-based overflow
33RISK
open ↗
Referência
CVE-2022-1388
CVE-2022-1388CRITICALunder attackransomware
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
open ↗
Referência
CVE-2026-58467
CVE-2026-58467HIGH
Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php
56RISK
open ↗
Referência
CVE-2026-10243
CVE-2026-10243MEDIUM
code-projects Smart Parking System Admin Endpoint missing authentication
33RISK
open ↗
Referência
CVE-2026-10123
CVE-2026-10123HIGH
TRENDnet TEW-432BRP formSetDomainFilter stack-based overflow
41RISK
open ↗
Referência
CVE-2026-10121
CVE-2026-10121HIGH
TRENDnet TEW-432BRP formSetUrlFilter stack-based overflow
41RISK
open ↗
Referência
CVE-2018-25422
CVE-2018-25422HIGH
MOGG web simulator Script All Version SQL Injection via play.php
41RISK
open ↗
Referência
CVE-2026-13587
CVE-2026-13587MEDIUM
seladb PcapPlusPlus LightPcapNg light_pcapng.c parse_by_block_type heap-based overflow
33RISK
open ↗
Referência
CVE-2014-7226
CVE-2014-7226—
The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2017-17614
CVE-2017-17614—
Food Order Script 1.0 has SQL Injection via the /list city parameter.
23RISK
open ↗
← previouspage 280 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.