Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2017-15081
CVE-2017-15081—
In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.
23RISK
open ↗
Referência
CVE-2017-17562
CVE-2017-17562HIGHunder attack
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. T
100RISK
open ↗
Referência✓ VexDay Proof
Fastpublish CMS 1.6.9 - config[fsBase] Remote File Inclusion
CVE-2006-2726—webappsphp
PHP remote file inclusion vulnerability in Fastpublish CMS 1.6.9.d allows remote attackers to include arbitrary files vi
28RISK
open ↗
Referência
CVE-2019-5420
CVE-2019-5420—
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess th
60RISK
open ↗
Referência✓ VexDay Proof
aspWebLinks 2.0 - SQL Injection / Admin Pass Change
CVE-2006-2847—webappsasp
SQL injection vulnerability in links.asp in aspWebLinks 2.0 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência
CVE-2026-12583
CVE-2026-12583HIGH
Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field
41RISK
open ↗
Referência
CVE-2026-15619
CVE-2026-15619MEDIUM
mosaxiv clawlet IPv4 tool_web_fetch.go web_fetch server-side request forgery
33RISK
open ↗
Referência
CVE-2026-15668
CVE-2026-15668MEDIUM
louisho5 picobot web Tool web.go WebTool.Execute server-side request forgery
33RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência
CVE-2026-12516
CVE-2026-12516MEDIUM
Fediverse Embeds < 1.5.8 - Unauthenticated SSRF via Media Proxy
33RISK
open ↗
Referência
CVE-2017-0285
CVE-2017-0285—
Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT
23RISK
open ↗
Referência
CVE-2017-16945
CVE-2017-16945—
The standardrestorer binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequen
23RISK
open ↗
Referência
CVE-2026-82554
CVE-2026-82554MEDIUM
SourceCodester Queue Management System add_customer.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-82487
CVE-2026-82487MEDIUM
Beetel 450TC3 password recovery
33RISK
open ↗
Referência
CVE-2026-10299
CVE-2026-10299MEDIUM
code-projects Online Hospital Management System viewdoctortimings.php resource injection
33RISK
open ↗
Referência✓ VexDay Proof
mxBB Module mx_modsdb 1.0 - Remote File Inclusion
CVE-2006-6560—webappsphp
PHP remote file inclusion vulnerability in includes/common.php in the mx_modsdb 1.0.0 module for MxBB (aka MX-System) Po
23RISK
open ↗
Referência
CVE-2026-11521
CVE-2026-11521MEDIUM
Mohammed-eid35 bank-management-system-springboot Transaction Endpoint TransactionController.java improper authorization
33RISK
open ↗
Referência
CVE-2026-12685
CVE-2026-12685HIGH
EscortWP <= 3.6.2 - Content Deletion via Vendor-Authored Backdoor
41RISK
open ↗
Referência★ 1
Proof of Concept for Reflected XSS in Lucee CFML (CVE-2026-29519)
CVE-2026-29519MEDIUM
Lucee CFML Server Reflected XSS via URL Path Parsing
33RISK
open ↗
Referência
CVE-2026-12276
CVE-2026-12276MEDIUM
LA-Studio Element Kit for Elementor < 1.6.1 - Unauthenticated Open Registration
33RISK
open ↗
Referência
CVE-2017-16962
CVE-2017-16962—
The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities vi
23RISK
open ↗
Referência
CVE-2017-16994
CVE-2017-16994—
The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, w
23RISK
open ↗
Referência
CVE-2026-82485
CVE-2026-82485MEDIUM
itsourcecode Sales and Inventory System pro_edit.php sql injection
33RISK
open ↗
Referência
CVE-2026-12187
CVE-2026-12187HIGH
GL.iNet GL-MT3000 Online Firmware Upgrade one_click_upgrade command injection
41RISK
open ↗
Referência
CVE-2017-17721
CVE-2017-17721—
CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, ass
23RISK
open ↗
Referência
CVE-2026-12186
CVE-2026-12186HIGH
GL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injection
41RISK
open ↗
Referência
CVE-2026-12223
CVE-2026-12223MEDIUM
Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection
33RISK
open ↗
Referência
CVE-2026-12219
CVE-2026-12219MEDIUM
Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection
33RISK
open ↗
← previouspage 357 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.