Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,190 exploits
Referência
CVE-2026-5811
SourceCodester Online Food Ordering System POST Parameter Actions.php save_product logic error
33RISK
open ↗Referência
CVE-2026-5810
SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting
33RISK
open ↗Referência
CVE-2026-11962
FileOrganizer < 1.2.0 - Authenticated Arbitrary File Upload via elFinder File Operations
41RISK
open ↗Referência
CVE-2010-1360
Multiple PHP remote file inclusion vulnerabilities in FAQEngine 4.24.00 allow remote attackers to execute arbitrary PHP
23RISK
open ↗Referência
CVE-2018-15140
Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authent
28RISK
open ↗Referência
CVE-2018-15172
TP-Link WR840N devices have a buffer overflow via a long Authorization HTTP header.
23RISK
open ↗Referência
CVE-2018-10576
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Improper authentica
23RISK
open ↗Referência
Microweber 1.2.11 - Remote Code Execution (RCE) (Authenticated)
OS Command Injection in microweber/microweber
53RISK
open ↗Referência
CVE-2026-5102
Totolink A3300R Parameter cstecgi.cgi setSmartQosCfg command injection
33RISK
open ↗Referência
CVE-2026-5101
Totolink A3300R Parameter cstecgi.cgi setLanCfg command injection
33RISK
open ↗Referência
CVE-2026-5046
Tenda FH1201 Parameter WrlExtraSet formWrlExtraSet stack-based overflow
41RISK
open ↗Referência
CVE-2026-5106
code-projects Exam Form Submission update_fst.php cross site scripting
33RISK
open ↗Referência
CVE-2026-5105
Totolink A3300R Parameter cstecgi.cgi setVpnPassCfg command injection
33RISK
open ↗Referência
CVE-2026-5198
code-projects Student Membership System Admin Login index.php sql injection
33RISK
open ↗Referência
CVE-2026-5197
code-projects Student Membership System delete_user.php sql injection
33RISK
open ↗Referência
CVE-2026-5196
code-projects Student Membership System delete_member.php sql injection
33RISK
open ↗Referência
CVE-2014-5082
Multiple SQL injection vulnerabilities in admin/admin.php in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus al
23RISK
open ↗Referência
CVE-2010-1885
The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server
60RISK
open ↗Referência
CVE-2014-5085
A Command Execution vulnerability exists in Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, whi
23RISK
open ↗Referência
CVE-2018-25381
Joomla Responsive Portfolio 1.6.1 SQL Injection via filter parameters
41RISK
open ↗Referência
CVE-2010-1947
Directory traversal vulnerability in scr/soustab.php in openMairie Openregistrecil 1.02, when register_globals is enable
23RISK
open ↗Referência
CVE-2016-5399
The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attac
23RISK
open ↗Referência
CVE-2026-14627
NousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter._is_allowed_user improper authentication
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.