Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

26,240 exploits

Referência

CVE-2018-25348

CVE-2018-25348HIGH

Joomla! Component Ek Rishta 2.10 SQL Injection via user_detail

41RISK

open ↗

Referência

CVE-2018-25347

CVE-2018-25347HIGH

WordPress Contact Form Maker Plugin 1.12.20 SQL Injection

41RISK

open ↗

Referência

CVE-2018-25346

CVE-2018-25346HIGH

WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php

41RISK

open ↗

Referência

CVE-2026-10262

CVE-2026-10262MEDIUM

code-projects Real State Services Login loginuser.php sql injection

33RISK

open ↗

Referência

CVE-2018-25345

CVE-2018-25345HIGH

10-Strike Network Scanner 3.0 Local Buffer Overflow SEH

41RISK

open ↗

Referência

CVE-2026-10261

CVE-2026-10261MEDIUM

CodeAstro Online Job Portal application_status.php sql injection

33RISK

open ↗

Referência

CVE-2014-2299

CVE-2014-2299—

Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10

50RISK

open ↗

Referência

CVE-2011-3829

CVE-2011-3829—

ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to obtain sensitive in

43RISK

open ↗

Referência

CVE-2026-10202

CVE-2026-10202MEDIUM

OFCMS JSON Query SystemDictController.java query sql injection

33RISK

open ↗

Referência

CVE-2014-2303

CVE-2014-2303—

Multiple SQL injection vulnerabilities in the file browser component (we_fs.php) in webEdition CMS before 6.2.7-s1.2 and

23RISK

open ↗

Referência

CVE-2015-7611

CVE-2015-7611—

Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary syst

50RISK

open ↗

Referência

CVE-2018-25349

CVE-2018-25349MEDIUM

userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header

33RISK

open ↗

Referência

CVE-2015-7709

CVE-2015-7709—

The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to b

60RISK

open ↗

Referência

CVE-2026-10201

CVE-2026-10201MEDIUM

Assimp UV Channel FBXExporter.cpp WriteObjects divide by zero

33RISK

open ↗

Referência

CVE-2026-10200

CVE-2026-10200MEDIUM

Assimp 4x4 Matrix glTFCommon.h CopyValue heap-based overflow

33RISK

open ↗

Referência

CVE-2026-10199

CVE-2026-10199MEDIUM

Assimp glTF2Asset.h LazyDict null pointer dereference

33RISK

open ↗

Referência✓ VexDay Proof

MyBulletinBoard (MyBB) 1.2.10 - Remote Code Execution

CVE-2008-0382—webappsphp

Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via

35RISK

open ↗

Referência

CVE-2019-25728

CVE-2019-25728HIGH

Care2x 2.7 Hospital Information System SQL Injection via ck_config

41RISK

open ↗

Referência

CVE-2019-12195

CVE-2019-12195—

TP-Link TL-WR840N v5 00000005 devices allow XSS via the network name. The attacker must log into the router by breaking

23RISK

open ↗

Referência

CVE-2017-11356

CVE-2017-11356—

The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users

23RISK

open ↗

Referência

CVE-2026-7589

CVE-2026-7589MEDIUM

ghantakiran splunk-mcp-integration CSV Export csv_export.py create_csv_export path traversal

33RISK

open ↗

Referência

CVE-2026-10771

CVE-2026-10771MEDIUM

crmeb crmeb_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgery

33RISK

open ↗

Referência

CVE-2026-7077

CVE-2026-7077MEDIUM

itsourcecode Courier Management System edit_parcel.php sql injection

33RISK

open ↗

Referência

CVE-2026-10125

CVE-2026-10125HIGH

Edimax BR-6478AC POST Request formPPPoESetup stack-based overflow

41RISK

open ↗

Referência✓ VexDay Proof

V3 Chat Profiles/Dating Script 3.0.2 - Authentication Bypass

CVE-2008-5785—webappsphp

SQL injection vulnerability in V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2014-2534

CVE-2014-2534—

/sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by rea

23RISK

open ↗

Referência

CVE-2026-7076

CVE-2026-7076MEDIUM

itsourcecode Courier Management System edit_branch.php sql injection

33RISK

open ↗

Referência

CVE-2026-7075

CVE-2026-7075MEDIUM

itsourcecode Construction Management System locations.php sql injection

33RISK

open ↗

Referência

CVE-2026-7074

CVE-2026-7074MEDIUM

itsourcecode Construction Management System execute1.php sql injection

33RISK

open ↗

Referência

CVE-2026-7073

CVE-2026-7073MEDIUM

itsourcecode Construction Management System execute.php sql injection

33RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.