Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2026-6011
OpenClaw assertPublicHostname web-fetch.ts server-side request forgery
33RISK
open ↗Referência
CVE-2018-18419
Stored XSS has been discovered in the upload section of ARDAWAN.COM User Management 1.1, as demonstrated by a .jpg filen
23RISK
open ↗Referência
CVE-2022-41333
An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below
33RISK
open ↗Referência✓ VexDay Proof
TFTP Server 1.4 - ST Buffer Overflow
Stack-based buffer overflow in TFTP Server SP 1.4 for Windows allows remote attackers to cause a denial of service or ex
50RISK
open ↗Referência
CVE-2026-10152
TaleLin lin-cms-spring-boot book Endpoint BookController.java access control
33RISK
open ↗Referência
CVE-2018-5983
SQL Injection exists in the JquickContact 1.3.2.2.1 component for Joomla! via a task=refresh&sid= request.
23RISK
open ↗Referência
CVE-2026-6000
code-projects Online Library Management System SQL Database Backup File library.sql information disclosure
33RISK
open ↗Referência
CVE-2026-5998
zhayujie chatgpt-on-wechat CowAgent API Memory Content Endpoint service.py dispatch path traversal
33RISK
open ↗Referência
CVE-2026-5997
Totolink A7100RU CGI cstecgi.cgi setLoginPasswordCfg os command injection
48RISK
open ↗Referência
CVE-2026-5994
Totolink A7100RU CGI cstecgi.cgi setTelnetCfg os command injection
48RISK
open ↗Referência
CVE-2026-5993
Totolink A7100RU CGI cstecgi.cgi setWiFiGuestCfg os command injection
48RISK
open ↗Referência
CVE-2026-5990
Tenda F451 SafeEmailFilter fromSafeEmailFilter stack-based overflow
41RISK
open ↗Referência
CVE-2026-5987
Sanluan PublicCMS FreeMarker Template AbstractFreemarkerView.java AbstractFreemarkerView.doRender special elements used in a template engine
33RISK
open ↗Referência✓ VexDay Proof
Neat weblog 0.2 - 'articleId' SQL Injection
SQL injection vulnerability in index.php in Neat weblog 0.2 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Referência
CVE-2026-5585
Tencent AI-Infra-Guard Task Detail Endpoint task_manager.go information disclosure
33RISK
open ↗Referência
CVE-2026-5584
Fosowl agenticSeek query Endpoint PyInterpreter.py PyInterpreter.execute code injection
33RISK
open ↗Referência
CVE-2026-5583
PHPGurukul Online Shopping Portal Project Parameter my-profile.php sql injection
33RISK
open ↗Referência
CVE-2026-5579
CodeAstro Online Classroom Parameter updatedetailsfromfaculty.php sql injection
33RISK
open ↗Referência
CVE-2026-5578
CodeAstro Online Classroom Parameter addassessment.php sql injection
33RISK
open ↗Referência
CVE-2026-5577
Song-Li cross_browser details Endpoint uniquemachine_app.py sql injection
33RISK
open ↗Referência
CVE-2026-5576
SourceCodester/jkev Record Management System Add Employee save_emp.php unrestricted upload
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.