Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,020cataloged exploits
35,276CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,446Referência 22,166GitHub PoC 14,080VulnCheck XDB 8,604Nuclei 4,251Metasploit 3,473✓ verified onlyrecentpopularrisk
21,899 exploits
Referência
CVE-2021-47983
CVE-2021-47983MEDIUM
WordPress Plugin Stripe Payments 2.0.39 Stored XSS via currency_code
33RISK
open ↗
Referência
CVE-2021-47982
CVE-2021-47982MEDIUM
WordPress Plugin WP-Paginate 2.1.3 Stored XSS via preset
33RISK
open ↗
Referência
CVE-2026-11467
CVE-2026-11467MEDIUM
jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal
33RISK
open ↗
Referência
CVE-2026-11463
CVE-2026-11463MEDIUM
USCiLab Cereal Shared Pointer type confusion
33RISK
open ↗
Referência
CVE-2026-11411
CVE-2026-11411MEDIUM
iAI Lab PDF AI App chatpdf.pro getExternalCacheDir path traversal
33RISK
open ↗
Referência
CVE-2006-2315
CVE-2006-2315—
PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and earlier allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Limbo CMS 1.0.4.2 - 'catid' SQL Injection
CVE-2006-2363—webappsphp
SQL injection vulnerability in the weblinks option (weblinks.html.php) in Limbo CMS allows remote attackers to execute a
23RISK
open ↗
Referência
CVE-2026-18959
CVE-2026-18959MEDIUM
yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal
33RISK
open ↗
Referência
CVE-2026-18958
CVE-2026-18958MEDIUM
imranrisal-dev Student-Management-System Login loginCheckTest.php sql injection
33RISK
open ↗
Referência
CVE-2026-70616
CVE-2026-70616HIGH
boringproxy 0.10.0 Resource Exhaustion DoS via GET /loading endpoint
41RISK
open ↗
Referência
CVE-2026-70615
CVE-2026-70615HIGH
boringproxy 0.10.0 SSH authorized_keys Injection via Tunnel Creation
41RISK
open ↗
Referência
CVE-2026-69111
CVE-2026-69111HIGH
Milvus 2.6.22, 3.0.0 Unauthenticated Denial of Service via /management/stop
41RISK
open ↗
Referência
CVE-2026-18927
CVE-2026-18927MEDIUM
imranrisal-dev Student-Management-System Shared Upload Helper student_profile_pic.php storeProfileImage unrestricted upload
33RISK
open ↗
Referência
CVE-2026-15360
CVE-2026-15360CRITICAL
Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args
48RISK
open ↗
Referência
CVE-2026-15210
CVE-2026-15210CRITICAL
Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force
48RISK
open ↗
Referência
CVE-2026-15230
CVE-2026-15230HIGH
YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure
41RISK
open ↗
Referência
CVE-2026-14553
CVE-2026-14553HIGH
Zportals < 6.3.4 - Subscriber+ Arbitrary File Upload
41RISK
open ↗
Referência
CVE-2025-15677
CVE-2025-15677LOW
GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories
28RISK
open ↗
Referência
CVE-2026-16993
CVE-2026-16993LOW
DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory
28RISK
open ↗
Referência
CVE-2026-16981
CVE-2026-16981MEDIUM
DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR
33RISK
open ↗
Referência
CVE-2026-16968
CVE-2026-16968MEDIUM
GeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users
33RISK
open ↗
Referência
CVE-2026-16942
CVE-2026-16942MEDIUM
WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS
33RISK
open ↗
Referência
CVE-2026-16940
CVE-2026-16940CRITICAL
Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal
48RISK
open ↗
Referência
CVE-2026-16746
CVE-2026-16746LOW
MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint
28RISK
open ↗
Referência
CVE-2026-16736
CVE-2026-16736HIGH
User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled
41RISK
open ↗
Referência
CVE-2026-16613
CVE-2026-16613MEDIUM
GDPR Cookie Compliance < 5.1.0 - Cookie Deletion and Forced Logout via CSRF
33RISK
open ↗
Referência
CVE-2026-16605
CVE-2026-16605HIGH
MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization
41RISK
open ↗
Referência
CVE-2026-16604
CVE-2026-16604HIGH
Content Protector (Passster) < 4.3.6 - Unauthenticated Protected Content Disclosure via Content-Lock Block data-content Attribute
41RISK
open ↗
Referência
CVE-2026-16603
CVE-2026-16603HIGH
Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API
41RISK
open ↗
Referência
CVE-2026-16602
CVE-2026-16602HIGH
Content Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint
41RISK
open ↗
← previouspage 343 / 730next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.