Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2026-5565
code-projects Simple Laundry System Parameter delmemberinfo.php sql injection
33RISK
open ↗Referência
CVE-2026-108620
JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatch
33RISK
open ↗Referência
CVE-2026-108618
JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit Endpoint
33RISK
open ↗Referência✓ VexDay Proof
CKGold Shopping Cart 2.5 - 'category_id' SQL Injection
SQL injection vulnerability in item.php in CartKeeper CKGold Shopping Cart 2.5 and 2.7 allows remote attackers to execut
23RISK
open ↗Referência
CVE-2014-4936
The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE)
43RISK
open ↗Referência✓ VexDay Proof
shibby shop 2.2 - Multiple Vulnerabilities
upgrade.asp in sHibby sHop 2.2 and earlier does not require administrative authentication, which allows remote attackers
23RISK
open ↗Referência
CVE-2013-1763
Array index error in the __sock_diag_rcv_msg function in net/core/sock_diag.c in the Linux kernel before 3.7.10 allows l
23RISK
open ↗Referência
CVE-2026-34108
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text.php
48RISK
open ↗Referência✓ VexDay Proof
aeDating 4.1 - dir[inc] Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in AEDating 4.1, and possibly earlier versions, allow remote attacker
28RISK
open ↗Referência✓ VexDay Proof
Joomla! Component EXP Shop - 'catid' SQL Injection
SQL injection vulnerability in the EXP Shop (com_expshop) component 1.0 for Joomla! allows remote attackers to execute a
23RISK
open ↗Referência
CVE-2026-82545
itsourcecode Sales and Inventory System sup_searchfrm.php sql injection
33RISK
open ↗Referência
CVE-2026-82541
itsourcecode Sales and Inventory System sup_edit.php sql injection
33RISK
open ↗Referência
CVE-2026-34107
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate.php
48RISK
open ↗Referência
CVE-2011-0512
SQL injection vulnerability in team.php in the Teams Structure module 3.0 for PHP-Fusion allows remote attackers to exec
23RISK
open ↗Referência
CVE-2012-2275
Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijac
23RISK
open ↗Referência
CVE-2026-19715
WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File
41RISK
open ↗Referência✓ VexDay Proof
Dana IRC 1.3 - Remote Buffer Overflow (PoC)
Stack-based buffer overflow in artegic Dana IRC client 1.3 and earlier allows remote attackers to cause a denial of serv
23RISK
open ↗Referência
CVE-2026-9584
code-projects Project Management System Login chk.php sql injection
33RISK
open ↗Referência
CVE-2026-106099
WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export
33RISK
open ↗Referência
CVE-2026-105975
CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference
33RISK
open ↗Referência
CVE-2026-103307
Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook
41RISK
open ↗Referência
CVE-2018-7756
RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TCP
35RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.