Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2026-5333
DefaultFuction Content-Management-System tools.php command injection
33RISK
open ↗Referência
CVE-2026-2699
EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)
75RISK
open ↗Referência
CVE-2026-5453
Rico só vantagem pra investir App br.com.rico.mobile SegmentSettingsModule.java hard-coded key
33RISK
open ↗Referência
CVE-2012-4927
SQL injection vulnerability in Limesurvey (a.k.a PHPSurveyor) before 1.91+ Build 120224 and earlier allows remote attack
23RISK
open ↗Referência
CVE-2016-20049
JAD 1.5.8e-1kali1 Stack-Based Buffer Overflow Remote Code Execution
48RISK
open ↗Referência
CVE-2026-4996
Sinaptik AI PandasAI pandasai-lancedb Extension lancedb.py get_relevant_docs_by_id sql injection
33RISK
open ↗Referência
CVE-2026-4995
wandb OpenUI Window Message Event index.html cross site scripting
33RISK
open ↗Referência
CVE-2026-4994
wandb OpenUI APIStatusError server.py generic_exception_handler information exposure
33RISK
open ↗Referência
CVE-2025-15445
Restaurant Cafeteria <= 0.4.6 - Subscriber+ Arbitrary Plugin Installation/Activation
33RISK
open ↗Referência
CVE-2015-3000
SysAid Help Desk before 15.2 allows remote attackers to cause a denial of service (CPU and memory consumption) via a lar
23RISK
open ↗Referência✓ VexDay Proof
FaScript FaPhoto 1.0 - 'show.php' SQL Injection
SQL injection vulnerability in show.php in FaScript FaPhoto 1.0, when magic_quotes_gpc is disabled, allows remote attack
23RISK
open ↗Referência
CVE-2026-9709
Themeco Cornerstone < 7.8.9 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Meta Disclosure
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.