Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2019-25704
CVE-2019-25704HIGH
Kados R10 GreenBee SQL Injection via filter_user_mail
41RISK
open ↗
Referência
CVE-2019-25702
CVE-2019-25702HIGH
Kados R10 GreenBee SQL Injection via id_project Parameter
41RISK
open ↗
Referência
CVE-2019-25700
CVE-2019-25700HIGH
Kados R10 GreenBee SQL Injection via sort_direction Parameter
41RISK
open ↗
Referência
CVE-2019-25698
CVE-2019-25698HIGH
Kados R10 GreenBee SQL Injection via id_to_delete Parameter
41RISK
open ↗
Referência
CVE-2019-25696
CVE-2019-25696HIGH
Kados R10 GreenBee SQL Injection via language_tag Parameter
41RISK
open ↗
Referência
CVE-2019-25694
CVE-2019-25694HIGH
Kados R10 GreenBee SQL Injection via user2reset
41RISK
open ↗
Referência
CVE-2026-5634
CVE-2026-5634MEDIUM
projectworlds Car Rental Project Parameter book_car.php sql injection
33RISK
open ↗
Referência
CVE-2026-5632
CVE-2026-5632MEDIUM
assafelovic gpt-researcher HTTP REST API Endpoint missing authentication
33RISK
open ↗
Referência
CVE-2026-5631
CVE-2026-5631MEDIUM
assafelovic gpt-researcher ws Endpoint server_utils.py extract_command_data code injection
33RISK
open ↗
Referência
CVE-2026-5630
CVE-2026-5630MEDIUM
assafelovic gpt-researcher Report API app.py cross site scripting
33RISK
open ↗
Referência
CVE-2026-5629
CVE-2026-5629HIGH
Belkin F9K1015 formSetFirewall stack-based overflow
41RISK
open ↗
Referência
CVE-2026-5628
CVE-2026-5628HIGH
Belkin F9K1015 Setting formSetSystemSettings stack-based overflow
41RISK
open ↗
Referência
CVE-2026-5625
CVE-2026-5625MEDIUM
assafelovic gpt-researcher WebSocket researcher.py cross site scripting
33RISK
open ↗
Referência
CVE-2026-5621
CVE-2026-5621MEDIUM
ChrisChinchilla Vale-MCP HTTP index.ts os command injection
33RISK
open ↗
Referência
CVE-2026-5620
CVE-2026-5620MEDIUM
itsourcecode Construction Management System Parameter borrowed_equip_report.php sql injection
33RISK
open ↗
Referência
CVE-2026-5619
CVE-2026-5619MEDIUM
Braffolk mcp-summarization-functions summarize_command mcp-server.ts os command injection
33RISK
open ↗
Referência
CVE-2026-5618
CVE-2026-5618MEDIUM
kalcaddle kodbox shareMake/shareCheck server-side request forgery
33RISK
open ↗
Referência
CVE-2026-5615
CVE-2026-5615MEDIUM
givanz Vvvebjs File Upload Endpoint upload.php cross site scripting
48RISK
open ↗
Referência✓ VexDay Proof
PlaySms 0.9.3 - Multiple Local/Remote File Inclusions
CVE-2008-5881—webappsphp
Multiple directory traversal vulnerabilities in playSMS 0.9.3 allow remote attackers to include and execute arbitrary lo
23RISK
open ↗
Referência
CVE-2014-1564
CVE-2014-1564—
Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize m
23RISK
open ↗
Referência
CVE-2014-1618
CVE-2014-1618—
Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2017-11120
CVE-2017-11120—
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
23RISK
open ↗
Referência
CVE-2026-14743
CVE-2026-14743MEDIUM
code-projects Real State Services normalHomeSale.php sql injection
33RISK
open ↗
Referência
CVE-2018-25435
CVE-2018-25435MEDIUM
ZeusCart 4.0 Deactivate Customer Accounts CSRF
33RISK
open ↗
Referência
CVE-2015-6965
CVE-2015-6965—
Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for Wo
23RISK
open ↗
Referência
CVE-2026-78141
CVE-2026-78141MEDIUM
Tenda CH22 exeCommand formexeCommand command injection
33RISK
open ↗
Referência
CVE-2016-6515
CVE-2016-6515—
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
35RISK
open ↗
Referência
CVE-2015-6545
CVE-2015-6545—
Cross-site request forgery (CSRF) vulnerability in ajax.php in Cerb before 7.0.4 allows remote attackers to hijack the a
23RISK
open ↗
Referência
CVE-2026-10246
CVE-2026-10246MEDIUM
SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting
33RISK
open ↗
Referência
CVE-2016-6601
CVE-2016-6601—
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows rem
60RISK
open ↗
← previouspage 347 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.