Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência✓ VexDay Proof
E-Uploader Pro 1.0 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in E-Uploader Pro 1.0 (aka Uploader PRO), when magic_quotes_gpc is disabled, allo
23RISK
open ↗Referência✓ VexDay Proof
Avahi < 0.6.24 - mDNS Daemon Remote Denial of Service
The originates_from_local_legacy_unicast_socket function (avahi-core/server.c) in avahi-daemon in Avahi before 0.6.24 al
50RISK
open ↗Referência
CVE-2026-109525
girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization
33RISK
open ↗Referência✓ VexDay Proof
Orca 2.0/2.0.2 - 'params.php?gConf[dir][layouts]' Remote File Inclusion
PHP remote file inclusion vulnerability in layout/default/params.php in Boonex Orca 2.0 and 2.0.2, when register_globals
23RISK
open ↗Referência✓ VexDay Proof
Tips Complete Website 1.2.0 - 'tipid' SQL Injection
SQL injection vulnerability in tip.php in Tips Complete Website 1.2.0 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência
CVE-2018-5405
The Quest Kace K1000 Appliance is vulnerable to JavaScript injection.
23RISK
open ↗Referência✓ VexDay Proof
ClipShare Pro 2006-2007 - 'chid' SQL Injection
SQL injection vulnerability in channel_detail.php in ClipShare Pro 4, and 2006 through 2007, allows remote attackers to
23RISK
open ↗Referência
CVE-2021-31933
A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a paramete
46RISK
open ↗Referência
CVE-2018-5702
Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access con
28RISK
open ↗Referência
CVE-2021-46424
Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to de
50RISK
open ↗Referência✓ VexDay Proof
Ikon ADManager 2.1 - Remote Database Disclosure
Ikon AdManager 2.1 and earlier stores sensitive information under the web root with insufficient access control, which a
23RISK
open ↗Referência
CVE-2026-7518
Open5GS AMF SBI Endpoint sdmsubscription-notify amf_namf_callback_handle_sdm_data_change_notify denial of service
33RISK
open ↗Referência
CVE-2025-71284
Synway SMG Gateway Management Software OS Command Injection via radius_address
48RISK
open ↗Referência
CVE-2026-5407
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
33RISK
open ↗Referência
CVE-2026-6534
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
33RISK
open ↗Referência
CVE-2026-6531
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
33RISK
open ↗Referência
CVE-2022-0824
Improper Access Control to Remote Code Execution in webmin/webmin
78RISK
open ↗Referência
CVE-2026-7585
Open5GS AMF nudm-handler.c amf_nudm_sdm_handle_provisioned denial of service
33RISK
open ↗Referência
CVE-2026-7583
Open5GS BSF context.c bsf_sess_find_by_ipv6prefix denial of service
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.