Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2026-9512
CVE-2026-9512MEDIUM
Totolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injection
33RISK
open ↗
Referência
CVE-2026-12987
CVE-2026-12987HIGH
Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration
41RISK
open ↗
Referência
CVE-2026-9511
CVE-2026-9511MEDIUM
Totolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injection
33RISK
open ↗
Referência
CVE-2026-9498
CVE-2026-9498MEDIUM
Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine
33RISK
open ↗
Referência
CVE-2026-14849
CVE-2026-14849LOW
Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files
28RISK
open ↗
Referência
CVE-2026-12906
CVE-2026-12906LOW
RTMKit Addons for Elementor < 2.0.9 - Contributor+ Private Post Title Disclosure
28RISK
open ↗
Referência
CVE-2020-8794
CVE-2020-8794—
OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for mult
60RISK
open ↗
Referência✓ VexDay Proof
Mambo Component Ricette 1.0 - SQL Injection
CVE-2008-0841—webappsphp
SQL injection vulnerability in index.php in the Giorgio Nordo Ricette (com_ricette) 1.0 component for Joomla! and Mambo
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_clasifier - 'cat_id' SQL Injection
CVE-2008-0842—webappsphp
SQL injection vulnerability in index.php in the Classifier (com_clasifier) component for Joomla! allows remote attackers
23RISK
open ↗
Referência
CVE-2018-5981
CVE-2018-5981—
SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter.
23RISK
open ↗
Referência
CVE-2026-15479
CVE-2026-15479MEDIUM
H3C NX15 Administrator Password Modification Endpoint modify change_passwd password recovery
33RISK
open ↗
Referência
CVE-2026-16200
CVE-2026-16200MEDIUM
zevorn rt-claw RPC swarm.c claw_tool_invoke authorization
33RISK
open ↗
Referência
CVE-2025-15665
CVE-2025-15665MEDIUM
BEAF < 4.7.1 - Admin+ Stored XSS via Widget Shortcode Field
33RISK
open ↗
Referência
CVE-2020-8813
CVE-2020-8813—
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a
60RISK
open ↗
Referência
CVE-2021-40378
CVE-2021-40378—
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. /cgi-bin/support/killp
28RISK
open ↗
Referência
CVE-2026-44195
CVE-2026-44195MEDIUM
OPNsense: Authentication lockout bypass
33RISK
open ↗
Referência
CVE-2018-12524
CVE-2018-12524—
An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /lib/ provi
23RISK
open ↗
Referência
CVE-2026-108669
CVE-2026-108669MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/knowledge/embedding/search
33RISK
open ↗
Referência
CVE-2018-6892
CVE-2018-6892—
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RISK
open ↗
Referência
CVE-2026-13703
CVE-2026-13703MEDIUM
SEO Redirection Plugin – 301 Redirect Manager < 9.19 - Subscriber+ Redirect Rule Disclosure
33RISK
open ↗
Referência
CVE-2018-14328
CVE-2018-14328—
Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensiti
28RISK
open ↗
Referência
Webrun 3.6.0.42 - 'P_0' SQL Injection
CVE-2021-43650—webappsmultiple
WebRun 3.6.0.42 is vulnerable to SQL Injection via the P_0 parameter used to set the username during the login process.
23RISK
open ↗
Referência✓ VexDay Proof
BlogMe PHP 1.1 - 'comments.php' SQL Injection
CVE-2008-2175—webappsphp
SQL injection vulnerability in comments.php in Gamma Scripts BlogMe PHP 1.1 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2018-6892
CVE-2018-6892—
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RISK
open ↗
Referência✓ VexDay Proof
Cplinks 1.03 - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2008-2180—webappsphp
Multiple SQL injection vulnerabilities in cpLinks 1.03, when magic_quotes_gpc is disabled, allow remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Online Rental Property Script 4.5 - 'pid' SQL Injection
CVE-2008-2190—webappsphp
SQL injection vulnerability in index.php in Online Rent (aka Online Rental Property Script) 4.5 and earlier allows remot
23RISK
open ↗
Referência✓ VexDay Proof
wPortfolio 0.3 - Admin Password Changing
CVE-2008-5221—webappsphp
The account_save action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not
23RISK
open ↗
Referência
CVE-2018-6892
CVE-2018-6892—
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RISK
open ↗
Referência
CSZ CMS 1.2.9 - 'Multiple' Blind SQLi(Authenticated)
CVE-2021-43701—webappsphp
CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/articl
23RISK
open ↗
Referência
CVE-2026-108634
CVE-2026-108634MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission deleteBatch Endpoint
33RISK
open ↗
← previouspage 324 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.