Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2015-1577
CVE-2015-1577—
Directory traversal vulnerability in u5admin/deletefile.php in u5CMS before 3.9.4 allows remote attackers to write to ar
23RISK
open ↗
Referência
CVE-2026-43638
CVE-2026-43638MEDIUM
Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import
33RISK
open ↗
Referência✓ VexDay Proof
my-gesuad 0.9.14 - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2009-1826—webappsphp
modules/admuser.php in myGesuad 0.9.14 (aka 0.9) does not require administrative authentication, which allows remote aut
23RISK
open ↗
Referência✓ VexDay Proof
Mozilla Firefox 3.0.10 - 'KEYGEN' Remote Denial of Service
CVE-2009-1828—dosmultiple
Mozilla Firefox 3.0.10 allows remote attackers to cause a denial of service (infinite loop, application hang, and memory
23RISK
open ↗
Referência
CVE-2026-61459
CVE-2026-61459CRITICAL
MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools
48RISK
open ↗
Referência
CVE-2026-8346
CVE-2026-8346MEDIUM
D-Link DIR-816 portForward command injection
33RISK
open ↗
Referência
CVE-2026-8320
CVE-2026-8320MEDIUM
jishenghua jshERP updatePlatformConfigByKey Endpoint UserService.java getUserByWeixinCode server-side request forgery
33RISK
open ↗
Referência
CVE-2026-8319
CVE-2026-8319MEDIUM
aiwaves-cn agents cheshire_cat_core stray_cat.py recall_relevant_memories_to_working_memory resource consumption
33RISK
open ↗
Referência
CVE-2026-8318
CVE-2026-8318MEDIUM
VectifyAI PageIndex PDF Table of Contents page_index.py toc_transformer infinite loop
33RISK
open ↗
Referência
CVE-2026-43640
CVE-2026-43640HIGH
Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key
41RISK
open ↗
Referência
CVE-2026-43639
CVE-2026-43639HIGH
Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients
41RISK
open ↗
Referência
CVE-2026-11868
CVE-2026-11868MEDIUM
WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation
33RISK
open ↗
Referência
CVE-2026-66028
CVE-2026-66028HIGH
Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client Email
41RISK
open ↗
Referência
CVE-2022-44877
CVE-2022-44877CRITICALunder attack
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execut
100RISK
open ↗
Referência
CVE-2023-2246
CVE-2023-2246MEDIUM
SourceCodester Online Pizza Ordering System unrestricted upload
33RISK
open ↗
Referência
CVE-2023-22809
CVE-2023-22809HIGH
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
68RISK
open ↗
Referência
CVE-2010-1060
CVE-2010-1060—
Directory traversal vulnerability in staff/app/common.inc.php in Phpkobo Short URL 1.01, when magic_quotes_gpc is disabl
23RISK
open ↗
Referência
CVE-2025-71408
CVE-2025-71408HIGH
NLTK < 3.9.3 Eval Injection via collocations.py Command-Line Arguments
41RISK
open ↗
Referência
CVE-2012-2580
CVE-2012-2580—
Cross-site scripting (XSS) vulnerability in the Postie plugin 1.4.3, and possibly before 1.5.15, for WordPress allows re
23RISK
open ↗
Referência✓ VexDay Proof
ExBB Italiano 0.2 - exbb[home_path] Remote File Inclusion
CVE-2006-4488—webappsphp
PHP remote file inclusion vulnerability in modules/userstop/userstop.php in ExBB Italia 0.2 and earlier, when register_g
23RISK
open ↗
Referência
CVE-2026-111222
CVE-2026-111222HIGH
Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting
41RISK
open ↗
Referência
CVE-2026-110694
CVE-2026-110694MEDIUM
OAID Tengine tmfile Model Loader tm2_serializer.c get_tm_file_model out-of-bounds
33RISK
open ↗
Referência
CVE-2026-111218
CVE-2026-111218HIGH
Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters
41RISK
open ↗
Referência✓ VexDay Proof
Akarru 0.4.3.34 - 'bm_content' Remote File Inclusion
CVE-2006-4645—webappsphp
PHP remote file inclusion vulnerability in akarru.gui/main_content.php in Akarru Social BookMarking Engine 0.4.3.34 and
23RISK
open ↗
Referência✓ VexDay Proof
Jetik Emlak ESA 2.0 - Multiple SQL Injections
CVE-2008-5992—webappsphp
Multiple SQL injection vulnerabilities in Jetik Emlak Sistem A (ESA) 2.0 allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2009-4542
CVE-2009-4542—
Cross-site scripting (XSS) vulnerability in newticket.php in IsolSoft Support Center 2.5 allows remote attackers to inje
23RISK
open ↗
Referência
CVE-2026-61511
CVE-2026-61511CRITICAL
vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
63RISK
open ↗
Referência
CVE-2023-22855
CVE-2023-22855CRITICAL
Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 808
53RISK
open ↗
Referência
CVE-2023-23488
CVE-2023-23488CRITICAL
The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerabilit
85RISK
open ↗
Referência
CVE-2023-3519
CVE-2023-3519CRITICALunder attackransomware
Unauthenticated remote code execution
100RISK
open ↗
← previouspage 348 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.