Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,190 exploits
Referência
CVE-2026-105190
CVE-2026-105190MEDIUM
Easy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Registration Disabled
33RISK
open ↗
Referência
CVE-2026-85701
CVE-2026-85701MEDIUM
ramon-victor freegpt-webui Authentication Check __init__.py ChatCompletion.create missing authentication
33RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_gmaps 1.00 - 'mapId' SQL Injection
CVE-2007-4128—webappsphp
SQL injection vulnerability in index.php in the Firestorm Technologies GMaps (com_gmaps) 1.00 component for Joomla! allo
23RISK
open ↗
Referência
CVE-2026-93509
CVE-2026-93509MEDIUM
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer Amount
33RISK
open ↗
Referência✓ VexDay Proof
AuraCMS Forum Module - SQL Injection
CVE-2007-4171—webappsphp
SQL injection vulnerability in komentar.php in the Forum Module for auraCMS (Modul Forum Sederhana) allows remote attack
23RISK
open ↗
Referência
CVE-2026-6958
CVE-2026-6958HIGH
Acunetix 25.11.251107123 Local Privilege Escalation via wvsc.exe
41RISK
open ↗
Referência
CVE-2026-6958
CVE-2026-6958HIGH
Acunetix 25.11.251107123 Local Privilege Escalation via wvsc.exe
41RISK
open ↗
Referência
CVE-2026-85522
CVE-2026-85522MEDIUM
valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds
33RISK
open ↗
Referência
CVE-2026-85514
CVE-2026-85514MEDIUM
StackStorm st2 API Key auth.py privileges management
33RISK
open ↗
Referência
CVE-2019-0232
CVE-2019-0232—
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0
60RISK
open ↗
Referência
CVE-2026-107271
CVE-2026-107271MEDIUM
Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing
33RISK
open ↗
Referência
CVE-2018-18797
CVE-2018-18797—
School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.
23RISK
open ↗
Referência
CVE-2026-95210
CVE-2026-95210MEDIUM
Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid exten
13RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_Marketplace 1.1.1 - SQL Injection
CVE-2008-0689—webappsphp
SQL injection vulnerability in index.php in the Marketplace (com_marketplace) 1.1.1 and 1.1.1-pl1 component for Joomla!
23RISK
open ↗
Referência
CVE-2020-8425
CVE-2020-8425—
Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php.
23RISK
open ↗
Referência
CVE-2022-47986
CVE-2022-47986CRITICALunder attackransomware
IBM Aspera Faspex code execution
100RISK
open ↗
Referência
CVE-2022-48177
CVE-2022-48177MEDIUM
X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability v
33RISK
open ↗
Referência
CVE-2026-105193
CVE-2026-105193MEDIUM
Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking Hash
33RISK
open ↗
Referência
CVE-2026-107270
CVE-2026-107270HIGH
Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints
41RISK
open ↗
Referência
CVE-2026-107181
CVE-2026-107181HIGH
Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
41RISK
open ↗
Referência
CVE-2017-9769
CVE-2017-9769—
A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpe
60RISK
open ↗
Referência
CVE-2020-11798
CVE-2020-11798—
A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before
50RISK
open ↗
Referência
CVE-2026-105643
CVE-2026-105643HIGH
Ghost: Stored XSS via Embed Card Previews
41RISK
open ↗
Referência
CVE-2026-105387
CVE-2026-105387MEDIUM
girishsaraf Online-Appointment-Booking-System Patient Login cover.php mysqli_query sql injection
33RISK
open ↗
Referência
CVE-2020-14008
CVE-2020-14008—
Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in
35RISK
open ↗
Referência✓ VexDay Proof
neuron news 1.0 - 'index.php?q' Local File Inclusion
CVE-2007-5050—webappsphp
Directory traversal vulnerability in index.php in Neuron News 1.0 allows remote attackers to include and execute arbitra
23RISK
open ↗
Referência
CVE-2023-27010
CVE-2023-27010HIGH
Wondershare Dr.Fone v12.9.6 was discovered to contain weak permissions for the service WsDrvInst. This vulnerability all
41RISK
open ↗
Referência
CVE-2026-105389
CVE-2026-105389MEDIUM
feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload
33RISK
open ↗
Referência
CVE-2026-105388
CVE-2026-105388MEDIUM
feelec-yishu feelcrm-os Member Endpoint MemberController.class.php index sql injection
33RISK
open ↗
Referência✓ VexDay Proof
iziContents rc6 - Local/Remote File Inclusion
CVE-2007-5054—webappsphp
Multiple PHP remote file inclusion vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to execute ar
35RISK
open ↗
← previouspage 304 / 873next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.