Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2026-23751
Kofax Capture 6.0.0.0 Unauthenticated File Read/Write & SMB Coercion via .NET Remoting
48RISK
open ↗Referência
CVE-2026-41460
SocialEngine <= 7.8.0 SQL Injection via activity/index/get-memberall
48RISK
open ↗Referência✓ VexDay Proof
Absolute Banner Manager - Insecure Cookie Handling
Absolute Banner Manager .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by sett
23RISK
open ↗Referência✓ VexDay Proof
Absolute Live Support 5.1 - Insecure Cookie Handling
Xigla Software Absolute Live Support .NET 5.1 allows remote attackers to bypass authentication and gain administrative a
23RISK
open ↗Referência
CVE-2009-4789
Multiple PHP remote file inclusion vulnerabilities in the MojoBlog component RC 0.15 for Joomla! allow remote attackers
23RISK
open ↗Referência
CVE-2010-4852
Cross-site scripting (XSS) vulnerability in login.php in Eclime 1.1.2b allows remote attackers to inject arbitrary web s
23RISK
open ↗Referência
CVE-2014-0869
The decrypt function in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algori
23RISK
open ↗Referência
CVE-2014-0871
RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows remote att
23RISK
open ↗Referência
CVE-2014-0997
WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used i
23RISK
open ↗Referência
CVE-2026-7676
kerwincui FastBee Tool Download Endpoint ToolController.java ToolController.download path traversal
33RISK
open ↗Referência
CVE-2026-14845
NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget
33RISK
open ↗Referência
CVE-2026-14221
Easy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization
28RISK
open ↗Referência
CVE-2025-65133
A SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580. An unauthenticated
48RISK
open ↗Referência
CVE-2026-38533
An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attac
33RISK
open ↗Referência
CVE-2026-7675
Shenzhen Libituo Technology LBT-T300-HW1 apply.cgi start_lan buffer overflow
41RISK
open ↗Referência
CVE-2026-7673
crmeb_java Admin Upload UploadServiceImpl.java unrestricted upload
33RISK
open ↗Referência
CVE-2026-7644
ChatGPTNextWeb NextChat actions.ts addMcpServer improper authorization
33RISK
open ↗Referência
CVE-2026-39907
Unisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via WCF SOAP
41RISK
open ↗Referência
CVE-2026-39906
Unisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via .NET Remoting
41RISK
open ↗Referência
CVE-2026-39808
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F
100RISK
open ↗Referência
CVE-2026-7642
pskill9 website-downloader MCP index.ts download_website os command injection
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.