Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência✓ VexDay Proof
TinyIdentD 2.2 - Remote Buffer Overflow
CVE-2007-2711—remotewindows
Stack-based buffer overflow in TinyIdentD 2.2 and earlier allows remote attackers to execute arbitrary code via a long s
50RISK
open ↗
Referência
CVE-2016-7089
CVE-2016-7089—
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
23RISK
open ↗
Referência
CVE-2004-2502
CVE-2004-2502—
im-switch before 11.4-46.1 in Fedora Core 2 allows local users to overwrite arbitrary files via a symlink attack on the
23RISK
open ↗
Referência
CVE-2026-15939
CVE-2026-15939LOW
Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST API
28RISK
open ↗
Referência✓ VexDay Proof
PhotoKorn Gallery 1.52 - 'dir_path' Remote File Inclusion
CVE-2006-4670—webappsphp
Multiple PHP remote file inclusion vulnerabilities in PhotoKorn Gallery 1.52 and earlier allow remote attackers to execu
28RISK
open ↗
Referência
CVE-2026-17433
CVE-2026-17433MEDIUM
nanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization
33RISK
open ↗
Referência
CVE-2017-17597
CVE-2017-17597—
Nearbuy Clone Script 3.2 has SQL Injection via the category_list.php search parameter.
23RISK
open ↗
Referência
CVE-2026-17032
CVE-2026-17032CRITICAL
Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server
48RISK
open ↗
Referência
CVE-2026-14222
CVE-2026-14222LOW
Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization
28RISK
open ↗
Referência
CVE-2026-16948
CVE-2026-16948HIGH
Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure
41RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module Core - 'viewcat.php' SQL Injection
CVE-2007-1814—webappsphp
SQL injection vulnerability in viewcat.php in the Core module for Xoops allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2026-16267
CVE-2026-16267HIGH
Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field
41RISK
open ↗
Referência
CVE-2026-19243
CVE-2026-19243MEDIUM
HKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injection
33RISK
open ↗
Referência
CVE-2026-13342
CVE-2026-13342MEDIUM
Security Optimizer – The All-In-One Protection Plugin < 1.6.5 - Login Access IP Allowlist Bypass via post_password
33RISK
open ↗
Referência
CVE-2026-14820
CVE-2026-14820MEDIUM
Quiz And Survey Master < 11.1.3 - Unauthenticated User Enumeration and Password Oracle via Quiz Login
33RISK
open ↗
Referência
Sentrifugo 3.2 - File Upload Restriction Bypass
CVE-2019-15813—webappsphp
Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arb
35RISK
open ↗
Referência
CVE-2019-16113
CVE-2019-16113—
Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .j
60RISK
open ↗
Referência✓ VexDay Proof
XChat 2.6.7 (Windows) - Remote Denial of Service
CVE-2006-4455—doswindows
Unspecified vulnerability in Xchat 2.6.7 and earlier allows remote attackers to cause a denial of service (crash) via un
23RISK
open ↗
Referência
CVE-2021-39316
CVE-2021-39316HIGH
ZoomSounds <= 6.45 Unauthenticated Directory Traversal and Sensitive Information Dislosure
68RISK
open ↗
Referência
CVE-2018-9059
CVE-2018-9059—
Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code
60RISK
open ↗
Referência
SpeechBrain < 1.1.1 checkpoint metadata RCE via unsafe PyYAML parsing of CKPT.yaml.
CVE-2026-10036HIGH
SpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing
41RISK
open ↗
Referência
CVE-2026-26899
CVE-2026-26899HIGH
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr
41RISK
open ↗
Referência
Wordpress Plugin BulletProof Security 5.1 - Sensitive Information Disclosure
CVE-2021-39327MEDIUMwebappsphp
BulletProof Security <= 5.1 Sensitive Information Disclosure
70RISK
open ↗
Referência
CVE-2021-4034
CVE-2021-4034HIGHunder attackransomware
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗
Referência
CVE-2021-4034
CVE-2021-4034HIGHunder attackransomware
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗
Referência
CVE-2022-3141
CVE-2022-3141—
Translatepress Multilinugal < 2.3.3 - Admin+ SQLi
23RISK
open ↗
Referência
CVE-2022-31470
CVE-2022-31470—
An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12
50RISK
open ↗
Referência
CVE-2026-12396
CVE-2026-12396MEDIUM
WP Job Portal < 2.5.5 - Subscriber+ Arbitrary Job Approval, Featuring and Rejection
33RISK
open ↗
Referência
CVE-2026-15622
CVE-2026-15622MEDIUM
poco-ai poco-claw Workspace API workspace.py get_workspace_file authorization
33RISK
open ↗
Referência
CVE-2026-75078
CVE-2026-75078MEDIUM
SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting
33RISK
open ↗
← previouspage 284 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.