Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2026-85128
CVE-2026-85128HIGH
Choose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escalation via Registration Role Request
41RISK
open ↗
Referência✓ VexDay Proof
AllMyLinks 0.5.0 - 'index.php' Remote File Inclusion
CVE-2007-0171—webappsphp
PHP remote file inclusion vulnerability in index.php in AllMyLinks 0.5.0 and earlier allows remote attackers to execute
23RISK
open ↗
Referência
CVE-2026-92809
CVE-2026-92809MEDIUM
PrestaShop psgdpr through 1.4.3 GDPR Log Forgery
33RISK
open ↗
Referência✓ VexDay Proof
ThWboard 3.0b2.84-php5 - SQL Injection / Code Execution
CVE-2007-0340—webappsphp
SQL injection vulnerability in inc/header.inc.php in ThWboard 3.0b2.84-php5 and earlier allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
Apple Mac OSX 10.4.8 - SLP Daemon Service Registration Buffer Overflow (PoC)
CVE-2007-0355—dososx
Buffer overflow in the Apple Minimal SLP v2 Service Agent (slpd) in Mac OS X 10.4.11 and earlier, including 10.4.8, allo
23RISK
open ↗
Referência
CVE-2026-92775
CVE-2026-92775HIGH
Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetch
41RISK
open ↗
Referência✓ VexDay Proof
Uberghey 0.3.1 - 'FrontPage.php' Remote File Inclusion
CVE-2007-0359—webappsphp
PHP remote file inclusion vulnerability in frontpage.php in Uberghey CMS 0.3.1 allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
Oreon 1.2.3 RC4 - '/lang/index.php' Remote File Inclusion
CVE-2007-0360—webappsphp
PHP remote file inclusion vulnerability in lang/index.php in Oreon 1.2.3 RC4 and earlier allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
Neon Labs Website 3.2 - 'nl.php?g_strRootDir' Remote File Inclusion
CVE-2007-0496—webappsphp
PHP remote file inclusion vulnerability in lib/nl/nl.php in Neon Labs Website (nlws) 3.2 and earlier allows remote attac
23RISK
open ↗
Referência
CVE-2026-14236
CVE-2026-14236MEDIUM
Contact Form 7 – PayPal & Stripe Add-on < 2.5 - Open Redirect
33RISK
open ↗
Referência
CVE-2026-14203
CVE-2026-14203MEDIUM
Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title
33RISK
open ↗
Referência
CVE-2026-114266
CVE-2026-114266MEDIUM
ProjectWorlds Advanced Library Management System profile.php mysqli_query sql injection
33RISK
open ↗
Referência
CVE-2026-114265
CVE-2026-114265MEDIUM
ProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injection
33RISK
open ↗
Referência
CVE-2026-90857
CVE-2026-90857MEDIUM
SourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted upload
33RISK
open ↗
Referência
CVE-2026-82019
CVE-2026-82019LOW
TripleLift video-bundle.js DOM-based XSS via postMessage
28RISK
open ↗
Referência
CVE-2026-90713
CVE-2026-90713MEDIUM
vllm-project vLLM tiktoken vocab File mod.rs new denial of service
33RISK
open ↗
Referência
CVE-2026-90579
CVE-2026-90579MEDIUM
cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication
33RISK
open ↗
Referência
CVE-2026-114577
CVE-2026-114577MEDIUM
oretnom23 php-travel-agency-system Insertion insert.php sql injection
33RISK
open ↗
Referência
CVE-2026-90942
CVE-2026-90942CRITICAL
Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints
48RISK
open ↗
Referência
CVE-2026-90577
CVE-2026-90577MEDIUM
GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based overflow
33RISK
open ↗
Referência
CVE-2026-90566
CVE-2026-90566MEDIUM
Rizwan17 inventory-management-system Registration register.php createUserAccount improper authorization
33RISK
open ↗
Referência
CVE-2026-90565
CVE-2026-90565MEDIUM
Rizwan17 inventory-management-system dashboard.php access control
33RISK
open ↗
Referência
CVE-2026-90525
CVE-2026-90525MEDIUM
itsourcecode Sales and Inventory System cust_pos_trans.php sql injection
33RISK
open ↗
Referência
CVE-2026-90522
CVE-2026-90522MEDIUM
jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recovery
33RISK
open ↗
Referência
CVE-2026-82851
CVE-2026-82851LOW
Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR
28RISK
open ↗
Referência
CVE-2026-82847
CVE-2026-82847MEDIUM
Masteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course Highlights
33RISK
open ↗
Referência
CVE-2026-78122
CVE-2026-78122HIGH
docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems
41RISK
open ↗
Referência
CVE-2026-78049
CVE-2026-78049MEDIUM
Systerel S2OPC AddNodes Service sopc_node_mgt_helper_internal.c out-of-bounds
33RISK
open ↗
Referência
CVE-2026-76795
CVE-2026-76795MEDIUM
AeternaLabsHQ PullMD REST API Endpoint api server-side request forgery
33RISK
open ↗
Referência
CVE-2026-76785
CVE-2026-76785MEDIUM
amirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injection
33RISK
open ↗
← previouspage 349 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.