Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência✓ VexDay Proof
Easy-Clanpage 2.2 - 'id' SQL Injection
SQL injection vulnerability in index.php in the gallery module in Easy-Clanpage 2.2 allows remote attackers to execute a
23RISK
open ↗Referência
CVE-2026-6493
lukevella rallly Reset Password reset-password-form.tsx cross site scripting
33RISK
open ↗Referência
CVE-2026-5262
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
41RISK
open ↗Referência
CVE-2025-65135
In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin
48RISK
open ↗Referência
CVE-2026-6201
CodeAstro Online Job Portal Delete Job Posting job-delete.php access control
33RISK
open ↗Referência
CVE-2026-6200
Tenda F456 webtypelibrary formwebtypelibrary stack-based overflow
41RISK
open ↗Referência
CVE-2016-8811
For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3
23RISK
open ↗Referência
CVE-2014-4511
Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in
60RISK
open ↗Referência
CVE-2015-1028
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remo
23RISK
open ↗Referência
CVE-2022-38580
Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).
53RISK
open ↗Referência✓ VexDay Proof
GrapAgenda 0.1 - 'page' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in GrapAgenda 0.11 and earlier, when register_globals is enabled, a
23RISK
open ↗Referência✓ VexDay Proof
Danneo CMS 0.5.1 - Blind SQL Injection
SQL injection vulnerability in index.php in Danneo CMS 0.5.1 and earlier, when the Referers statistics option is enabled
23RISK
open ↗Referência
CVE-2011-5277
Multiple SQL injection vulnerabilities in signature.php in the Advanced Forum Signatures (aka afsignatures) plugin 2.0.4
23RISK
open ↗Referência
CVE-2026-5854
Totolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injection
53RISK
open ↗Referência
CVE-2026-5853
Totolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injection
53RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.