Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,190 exploits
Referência
CVE-2019-5418
CVE-2019-5418HIGHunder attack
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where spe
100RISK
open ↗
Referência
CVE-2021-47962
CVE-2021-47962MEDIUM
Savsoft Quiz 5.0 Persistent Cross-Site Scripting via User Settings
33RISK
open ↗
Referência
CVE-2021-47959
CVE-2021-47959HIGH
WordPress Plugin WPGraphQL 1.3.5 Denial of Service
41RISK
open ↗
Referência
CVE-2021-47958
CVE-2021-47958MEDIUM
CouchCMS 2.2.1 Server-Side Request Forgery via SVG upload
33RISK
open ↗
Referência
CVE-2018-6892
CVE-2018-6892—
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RISK
open ↗
Referência
CVE-2018-6892
CVE-2018-6892—
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RISK
open ↗
Referência
CVE-2018-6892
CVE-2018-6892—
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RISK
open ↗
Referência
CVE-2026-94278
CVE-2026-94278MEDIUM
File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat
33RISK
open ↗
Referência
CVE-2018-6941
CVE-2018-6941—
A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remot
23RISK
open ↗
Referência
CVE-2026-89289
CVE-2026-89289MEDIUM
Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint
33RISK
open ↗
Referência
CVE-2026-67216
CVE-2026-67216HIGH
cJSON cJSON_Compare Exponential Complexity Denial of Service
41RISK
open ↗
Referência
CVE-2026-67215
CVE-2026-67215HIGH
cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion
41RISK
open ↗
Referência
CVE-2019-16113
CVE-2019-16113—
Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .j
60RISK
open ↗
Referência
CVE-2019-17558
CVE-2019-17558HIGHunder attack
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A V
100RISK
open ↗
Referência
CVE-2026-41924
CVE-2026-41924CRITICAL
WDR201A WiFi Extender OS Command Injection via makeRequest.cgi
48RISK
open ↗
Referência
CVE-2026-41923
CVE-2026-41923CRITICAL
WDR201A WiFi Extender OS Command Injection via internet.cgi
48RISK
open ↗
Referência
CVE-2026-105172
CVE-2026-105172MEDIUM
itsourcecode Online Admission System login1.php sql injection
33RISK
open ↗
Referência
CVE-2026-7712
CVE-2026-7712MEDIUM
MindsDB Pickle pickle.loads deserialization
33RISK
open ↗
Referência
CVE-2026-7711
CVE-2026-7711MEDIUM
MindsDB Engine proc_wrapper.py exec unrestricted upload
33RISK
open ↗
Referência
CVE-2026-7710
CVE-2026-7710MEDIUM
YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication
33RISK
open ↗
Referência
CVE-2026-7788
CVE-2026-7788MEDIUM
Axle-Bucamp MCP-Docusaurus document.py get_content path traversal
33RISK
open ↗
Referência
CVE-2026-7780
CVE-2026-7780MEDIUM
Open5GS smf-registrations Endpoint udm-sm.c udm_state_operational denial of service
33RISK
open ↗
Referência
CVE-2026-7779
CVE-2026-7779MEDIUM
Open5GS authentication-subscription Endpoint nudr-handler.c udm_nudr_dr_handle_subscription_authentication denial of service
33RISK
open ↗
Referência
CVE-2026-41927
CVE-2026-41927HIGH
WDR201A WiFi Extender Stack-Based Buffer Overflow via firewall.cgi
41RISK
open ↗
Referência
CVE-2026-41926
CVE-2026-41926CRITICAL
WDR201A WiFi Extender OS Command Injection via firewall.cgi
48RISK
open ↗
Referência
CVE-2026-41925
CVE-2026-41925CRITICAL
WDR201A WiFi Extender OS Command Injection via adm.cgi (reboot_time)
48RISK
open ↗
Referência
CVE-2026-41922
CVE-2026-41922CRITICAL
WDR201A WiFi Extender OS Command Injection via wireless.cgi
48RISK
open ↗
Referência
CVE-2026-7743
CVE-2026-7743MEDIUM
CodeAstro Online Classroom studentdetails sql injection
33RISK
open ↗
Referência
CVE-2026-7742
CVE-2026-7742MEDIUM
CodeAstro Online Classroom facultylogin sql injection
33RISK
open ↗
Referência
CVE-2026-102616
CVE-2026-102616MEDIUM
risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection
33RISK
open ↗
← previouspage 316 / 873next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.