Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2026-19792
CVE-2026-19792HIGH
Tenda G0 httpd web management interface module setPortMapping buffer overflow
41RISK
open ↗
Referência
CVE-2026-12513
CVE-2026-12513MEDIUM
Shared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path Traversal
33RISK
open ↗
Referência
CVE-2026-19791
CVE-2026-19791HIGH
Tenda G0 httpd web management interface module addStaticRoute stack-based overflow
41RISK
open ↗
Referência
CVE-2026-16965
CVE-2026-16965MEDIUM
Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status
33RISK
open ↗
Referência
CVE-2026-16957
CVE-2026-16957LOW
Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure
28RISK
open ↗
Referência
CVE-2026-15386
CVE-2026-15386MEDIUM
Meow Gallery < 5.5.2 - Author+ Stored XSS via Attachment Alt-Text
33RISK
open ↗
Referência
CVE-2026-15361
CVE-2026-15361HIGH
Content Views < 4.5 - Subscriber+ SQL Injection via preview_request
41RISK
open ↗
Referência
CVE-2026-81420
CVE-2026-81420HIGH
Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter
41RISK
open ↗
Referência
CVE-2026-91005
CVE-2026-91005MEDIUM
SourceCodester Online Faculty Clearance System Profile Picture Upload edit_picture.php move_uploaded_file unrestricted upload
33RISK
open ↗
Referência
CVE-2026-16534
CVE-2026-16534CRITICAL
Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import
48RISK
open ↗
Referência
CVE-2026-16592
CVE-2026-16592LOW
WP Directory Kit <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes
28RISK
open ↗
Referência
CVE-2026-82701
CVE-2026-82701MEDIUM
code-projects Online Shopping System Search Functionality action.php sql injection
33RISK
open ↗
Referência
CVE-2026-82090
CVE-2026-82090CRITICAL
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM.  JavaScript code can alt
48RISK
open ↗
Referência
CVE-2026-14331
CVE-2026-14331MEDIUM
Subscribe2 < 10.46 - Reflected XSS via email Parameter
33RISK
open ↗
Referência
CVE-2026-91003
CVE-2026-91003CRITICAL
D-Link DI-8300 CGI Service rzgl.asp rzgl_asp stack-based overflow
48RISK
open ↗
Referência
CVE-2026-91001
CVE-2026-91001CRITICAL
D-Link DI-8400 DDNS Configuration ddns.asp ddns_asp stack-based overflow
48RISK
open ↗
Referência
CVE-2026-19790
CVE-2026-19790HIGH
Tenda G0 httpd Web Management module formSetPortMirror stack-based overflow
41RISK
open ↗
Referência★ 1
CVE-2026-19193 Proof of Concept
CVE-2026-19193HIGH
Jiangmin Antivirus Minifilter Port kvcore.sys MessageNotifyCallback access control
41RISK
open ↗
Referência
CVE-2026-90879
CVE-2026-90879MEDIUM
zyx0814 FilePress Publish search.php sql injection
33RISK
open ↗
Referência
CVE-2026-90877
CVE-2026-90877MEDIUM
SourceCodester Online Faculty Clearance System update_requirement_status.php sql injection
33RISK
open ↗
Referência
CVE-2017-5638
CVE-2017-5638CRITICALunder attackransomware
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISK
open ↗
Referência
CVE-2026-86279
CVE-2026-86279MEDIUM
SourceCodester Syllabus-Aligned Learning Management & Examination System Login auth_process.php session fixiation
33RISK
open ↗
Referência
CVE-2026-93580
CVE-2026-93580MEDIUM
InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook
33RISK
open ↗
Referência
CVE-2026-101145
CVE-2026-101145MEDIUM
Eleveo Call Recording Software User Management userAddAction.do ldap injection
33RISK
open ↗
Referência
CVE-2026-89003
CVE-2026-89003MEDIUM
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview
33RISK
open ↗
Referência
CVE-2026-102292
CVE-2026-102292MEDIUM
coolbeans1212 MateisHomePage-Website users.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-101039
CVE-2026-101039CRITICAL
FAST FAC1900R devdiscover Service copy_msg_element stack-based overflow
48RISK
open ↗
Referência
CVE-2026-89001
CVE-2026-89001MEDIUM
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings
33RISK
open ↗
Referência
CVE-2026-100311
CVE-2026-100311MEDIUM
mathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-96526
CVE-2026-96526LOW
MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route
28RISK
open ↗
← previouspage 343 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.