Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2015-6589
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before
28RISK
open ↗Referência
CVE-2026-108612
JeecgBoot through 3.9.5 Missing Authorization via /airag/word/deleteBatch
33RISK
open ↗Referência
CVE-2026-8235
8421bit MiniClaw System kernel.ts resolveSkillScriptPath os command injection
33RISK
open ↗Referência
CVE-2026-8226
Open5GS types.c ogs_pcc_rule_install_flow_from_media denial of service
33RISK
open ↗Referência
CVE-2026-8225
Open5GS delete Endpoint sm-sm.c pcf_npcf_smpolicycontrol_handle_delete denial of service
33RISK
open ↗Referência
CVE-2026-8209
Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction
33RISK
open ↗Referência
CVE-2026-18853
ZomboDroid Meme Generator App com.zombodroid.MemeGenerator t5.l.c path traversal
33RISK
open ↗Referência
CVE-2016-2385
Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER a
28RISK
open ↗Referência
CVE-2016-3672
The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not properly randomize t
23RISK
open ↗Referência
CVE-2019-12372
Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form.
23RISK
open ↗Referência
CVE-2026-20000
itsourcecode Hospital Management System viewprescriptionrecord.php sql injection
33RISK
open ↗Referência
CVE-2017-17635
MLM Forex Market Plan Script 2.0.4 has SQL Injection via the news_detail.php newid parameter or the event_detail.php eve
23RISK
open ↗Referência
CVE-2026-75012
TOTOLINK EX1200L Password Configuration cstecgi.cgi setPasswordCfg null pointer dereference
41RISK
open ↗Referência
CVE-2017-17636
MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter.
23RISK
open ↗Referência
CVE-2015-7858
SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via un
60RISK
open ↗Referência
CVE-2015-7889
The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions f
23RISK
open ↗Referência
CVE-2013-7025
Multiple cross-site scripting (XSS) vulnerabilities in ematStaticAlertTypes.jsp in the Alert Settings section in Dell So
23RISK
open ↗Referência
CVE-2016-3081
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, a
100RISK
open ↗Referência
CVE-2026-71503
Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template
33RISK
open ↗Referência
CVE-2026-17010
Saitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post Meta
33RISK
open ↗Referência
CVE-2026-77003
Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask
28RISK
open ↗Referência
CVE-2026-16959
Media Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connector
48RISK
open ↗Referência
CVE-2026-16988
GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.