Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2011-5230
Multiple SQL injection vulnerabilities in the selectUserIdByLoginPass function in seotoaster_core/application/models/Log
23RISK
open ↗Referência
CVE-2026-14315
Pixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event Submission
33RISK
open ↗Referência✓ VexDay Proof
Pixaria Gallery 1.x - 'class.Smarty.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Pixaria Gallery before 1.4.3 allow remote attackers to execute arb
28RISK
open ↗Referência
CVE-2010-4566
The web authentication form in the NT4 authentication component in Citrix Access Gateway Enterprise Edition 9.2-49.8 and
43RISK
open ↗Referência
CVE-2016-4177
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632
28RISK
open ↗Referência
CVE-2026-7704
AV Stumpfl Pixera Two Media Server Service Port 1338 path traversal
33RISK
open ↗Referência
CVE-2026-7702
toeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization
33RISK
open ↗Referência
CVE-2026-7699
Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection
33RISK
open ↗Referência
CVE-2026-16250
Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload
48RISK
open ↗Referência
CVE-2026-7217
Deepractice PromptX Document File index.ts read_pdf absolute path traversal
33RISK
open ↗Referência
CVE-2026-7221
TencentCloudBase CloudBase-MCP open-url API Endpoint interactive-server.ts openUrl server-side request forgery
33RISK
open ↗Referência
CVE-2026-7220
jackwrichards FastlyMCP fastly_cli Tool fastly-mcp.mjs os command injection
33RISK
open ↗Referência✓ VexDay Proof
vcart 3.3.2 - Multiple Remote File Inclusions
PHP remote file inclusion vulnerability in VisionBurst vcart 3.3.2 allows remote attackers to execute arbitrary PHP code
23RISK
open ↗Referência
CVE-2021-3394
Millennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1 has insecure folder per
23RISK
open ↗Referência
CVE-2026-66006
lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs
33RISK
open ↗Referência✓ VexDay Proof
ImageAlbum 2.0.0b2 - 'id' SQL Injection
Multiple SQL injection vulnerabilities in ImageAlbum 2.0.0b2 allow remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Referência
CVE-2016-4312
XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH
23RISK
open ↗Referência✓ VexDay Proof
RichStrong CMS - 'cat' SQL Injection
SQL injection vulnerability in showproduct.asp in RichStrong CMS allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗Referência
CVE-2026-14827
Calendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter
33RISK
open ↗Referência
CVE-2026-16194
zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery
33RISK
open ↗Referência
CVE-2026-16156
SourceCodester Class and Exam Timetabling System forexam.php cross site scripting
33RISK
open ↗Referência
CVE-2026-65693
Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.