Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2026-14322
CVE-2026-14322MEDIUM
Timetics < 1.0.57 - Unauthenticated Booking Auto-Approval via Arbitrary payment_method
33RISK
open ↗
Referência
CVE-2020-28328
CVE-2020-28328—
SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain
50RISK
open ↗
Referência
CVE-2026-12965
CVE-2026-12965CRITICAL
Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking
48RISK
open ↗
Referência
CVE-2020-28328
CVE-2020-28328—
SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain
50RISK
open ↗
Referência
CVE-2026-19978
CVE-2026-19978MEDIUM
jiantao88 android-mcp-server Command Execution index.js child_process.exec os command injection
33RISK
open ↗
Referência
CVE-2017-17649
CVE-2017-17649—
Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter.
23RISK
open ↗
Referência
CVE-2026-63769
CVE-2026-63769MEDIUM
Huginn < 2026.09.09 SSRF via ScenarioImport fetch_url Method
33RISK
open ↗
Referência
CVE-2016-0492
CVE-2016-0492—
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12
60RISK
open ↗
Referência
CVE-2016-0492
CVE-2016-0492—
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12
60RISK
open ↗
Referência
CVE-2016-3473
CVE-2016-3473—
Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0,
28RISK
open ↗
Referência
CentOS Control Web Panel 0.9.8.836 - Authentication Bypass
CVE-2019-13605—webappslinux
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in
28RISK
open ↗
Referência
CVE-2019-13720
CVE-2019-13720HIGHunder attack
Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap
83RISK
open ↗
Referência✓ VexDay Proof
Simplog 0.9.2 - 's' Remote Command Execution
CVE-2006-1778—webappsphp
Multiple SQL injection vulnerabilities in Jeremy Ashcraft Simplog 0.9.2 and earlier allow remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2026-19968
CVE-2026-19968MEDIUM
Open Asset Import Library Assimp 3DGS MDL7 Model LWOLoader.h ReadFaces_3DGS_MDL7 heap-based overflow
33RISK
open ↗
Referência
CVE-2026-19967
CVE-2026-19967MEDIUM
Open Asset Import Library Assimp File Compression.cpp decompressBlock heap-based overflow
33RISK
open ↗
Referência
CVE-2026-19966
CVE-2026-19966MEDIUM
CodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorization
33RISK
open ↗
Referência
CVE-2026-8155
CVE-2026-8155MEDIUM
BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR
33RISK
open ↗
Referência
CVE-2016-3987
CVE-2016-3987—
The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url para
28RISK
open ↗
Referência
CVE-2026-92920
CVE-2026-92920MEDIUM
admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled
33RISK
open ↗
Referência
CVE-2016-1525
CVE-2016-1525—
Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allow
60RISK
open ↗
Referência
CVE-2019-1619
CVE-2019-1619CRITICAL
Cisco Data Center Network Manager Authentication Bypass Vulnerability
85RISK
open ↗
Referência
CVE-2019-16117
CVE-2019-16117—
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admi
23RISK
open ↗
Referência
CVE-2026-63764
CVE-2026-63764HIGH
LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass
41RISK
open ↗
Referência
CVE-2019-16119
CVE-2019-16119—
SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/control
28RISK
open ↗
Referência
CVE-2019-1620
CVE-2019-1620CRITICAL
Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability
85RISK
open ↗
Referência
CVE-2014-10079
CVE-2014-10079—
In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hid
23RISK
open ↗
Referência
CVE-2026-92919
CVE-2026-92919HIGH
admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename
41RISK
open ↗
Referência✓ VexDay Proof
ig shop 1.0 - Code Execution / SQL Injection
CVE-2007-0134—webappsphp
Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the
28RISK
open ↗
Referência
CVE-2026-93309
CVE-2026-93309MEDIUM
O-RAN-SC SMO OAM VES Collector allocation of resources
33RISK
open ↗
Referência✓ VexDay Proof
Aratix 0.2.2b11 - '/inc/init.inc.php' Remote File Inclusion
CVE-2007-0135—webappsphp
PHP remote file inclusion vulnerability in inc/init.inc.php in Aratix 0.2.2 beta 11 and earlier, when register_globals i
23RISK
open ↗
← previouspage 320 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.