Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,190 exploits
Referência
CVE-2019-25757
CVE-2019-25757HIGH
Joomla vWishlist 1.0.1 SQL Injection via vproductid Parameter
41RISK
open ↗
Referência
WordPress Core 5.8.2 - 'WP_Query' SQL Injection
CVE-2022-21661HIGHwebappsphp
SQL injection in WordPress
78RISK
open ↗
Referência
CVE-2026-12823
CVE-2026-12823MEDIUM
Browserbase Skills Autobrowse Trace Artifact default permission
33RISK
open ↗
Referência
CVE-2014-8654
CVE-2014-8654—
Multiple cross-site request forgery (CSRF) vulnerabilities in Compal Broadband Networks (CBN) CH6640E and CG6640E Wirele
23RISK
open ↗
Referência
CVE-2017-17849
CVE-2017-17849—
A buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712 and earlier could allow remote HTTP servers to exec
28RISK
open ↗
Referência
CVE-2017-17849
CVE-2017-17849—
A buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712 and earlier could allow remote HTTP servers to exec
28RISK
open ↗
Referência
CVE-2026-110983
CVE-2026-110983MEDIUM
WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
33RISK
open ↗
Referência
CVE-2026-110505
CVE-2026-110505MEDIUM
Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass
33RISK
open ↗
Referência
CVE-2018-14064
CVE-2018-14064—
The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../..
50RISK
open ↗
Referência
CVE-2026-113486
CVE-2026-113486MEDIUM
Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF
33RISK
open ↗
Referência
CVE-2015-0554
CVE-2015-0554—
The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly rest
50RISK
open ↗
Referência
CVE-2017-5586
CVE-2017-5586—
OpenText Documentum D2 (formerly EMC Documentum D2) 4.x allows remote attackers to execute arbitrary commands via a craf
28RISK
open ↗
Referência
CVE-2023-22855
CVE-2023-22855CRITICAL
Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 808
53RISK
open ↗
Referência
CVE-2026-113485
CVE-2026-113485MEDIUM
Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF
33RISK
open ↗
Referência
CVE-2026-111967
CVE-2026-111967MEDIUM
MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute
33RISK
open ↗
Referência
CVE-2026-111032
CVE-2026-111032LOW
Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax
28RISK
open ↗
Referência✓ VexDay Proof
MyPHP CMS 0.3 - 'domain' Remote File Inclusion
CVE-2006-3478—webappsphp
PHP remote file inclusion vulnerability in styles/default/global_header.php in MyPHP CMS 0.3 and earlier, when register_
23RISK
open ↗
Referência
CVE-2017-5638
CVE-2017-5638CRITICALunder attackransomware
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISK
open ↗
Referência
CVE-2015-1479
CVE-2015-1479—
SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 buil
23RISK
open ↗
Referência
CVE-2017-0148
CVE-2017-0148HIGHunder attackransomware
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗
Referência
CVE-2026-83524
CVE-2026-83524CRITICAL
RedPort Optimizer wXa-223 System Clock datetime.php exec command injection
48RISK
open ↗
Referência
CVE-2017-16542
CVE-2017-16542—
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name param
23RISK
open ↗
Referência
CVE-2017-7237
CVE-2017-7237—
The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spicewor
23RISK
open ↗
Referência
CVE-2020-1147
CVE-2020-1147HIGHunder attack
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the softwar
100RISK
open ↗
Referência
CVE-2026-107097
CVE-2026-107097MEDIUM
Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe
33RISK
open ↗
Referência
CVE-2026-106647
CVE-2026-106647LOW
Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision
28RISK
open ↗
Referência✓ VexDay Proof
Sabdrimer PRO 2.2.4 - 'pluginpath' Remote File Inclusion
CVE-2006-3520—webappsphp
PHP remote file inclusion vulnerability in skins/advanced/advanced1.php in Sabdrimer Pro 2.2.4, when register_globals is
23RISK
open ↗
Referência
CVE-2020-11651
CVE-2020-11651CRITICALunder attack
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs cla
100RISK
open ↗
Referência✓ VexDay Proof
Active Auction Pro 7.1 - 'default.asp?catid' SQL Injection
CVE-2007-1712—webappsasp
SQL injection vulnerability in default.asp in ActiveWebSoftwares Active Auction Pro 7.1 allows remote attackers to execu
23RISK
open ↗
Referência
CVE-2026-82816
CVE-2026-82816MEDIUM
dibo-software diboot AI Session Endpoint ai-session authorization
33RISK
open ↗
← previouspage 318 / 873next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.