Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
LSoft ListServ < 16.5-2018a - Cross-Site Scripting
CVE-2019-15501—webappswindows
Reflected cross site scripting (XSS) in L-Soft LISTSERV before 16.5-2018a exists via the /scripts/wa.exe OK parameter.
38RISK
open ↗
Referência
CVE-2017-15959
CVE-2017-15959—
Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-200
23RISK
open ↗
Referência
CVE-2017-15983
CVE-2017-15983—
MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing
23RISK
open ↗
Referência
CVE-2026-18903
CVE-2026-18903MEDIUM
yeqifu warehouse FileController.java path traversal
33RISK
open ↗
Referência
CVE-2026-18902
CVE-2026-18902HIGH
H3C NX15 esps repeaterproc command injection
41RISK
open ↗
Referência
CVE-2025-10903
CVE-2025-10903MEDIUM
Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab
33RISK
open ↗
Referência
CVE-2017-1129
CVE-2017-1129—
IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it coul
50RISK
open ↗
Referência
CVE-2026-15539
CVE-2026-15539MEDIUM
SourceCodester Online Book Store System Book Image Upload Feature index.php books unrestricted upload
33RISK
open ↗
Referência
CVE-2026-15319
CVE-2026-15319MEDIUM
Sipeed PicoClaw Launcher access_control.go IPAllowlist access control
33RISK
open ↗
Referência
CVE-2017-17620
CVE-2017-17620—
Lawyer Search Script 1.1 has SQL Injection via the /lawyer-list city parameter.
23RISK
open ↗
Referência
CVE-2026-61460
CVE-2026-61460HIGH
Krayin CRM Insecure Direct Object Reference via Controllers
41RISK
open ↗
Referência
CVE-2026-15185
CVE-2026-15185MEDIUM
GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds
33RISK
open ↗
Referência
CVE-2026-3035
CVE-2026-3035MEDIUM
Authentication Bypass Using an Alternate Path or Channel in GitLab
33RISK
open ↗
Referência
CVE-2026-15318
CVE-2026-15318MEDIUM
Sipeed PicoClaw MQTT Channel mqtt.go authorization
33RISK
open ↗
Referência
CVE-2014-6287
CVE-2014-6287CRITICALunder attack
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗
Referência
CVE-2026-12517
CVE-2026-12517MEDIUM
Fediverse Embeds < 1.5.8 - Unauthenticated SSRF via Site Info Endpoint
33RISK
open ↗
Referência
CVE-2014-6287
CVE-2014-6287CRITICALunder attack
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗
Referência
CVE-2019-2215
CVE-2019-2215HIGHunder attack
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RISK
open ↗
Referência
CVE-2017-15967
CVE-2017-15967—
Mailing List Manager Pro 3.0 allows SQL Injection via the edit parameter to admin/users in a sort=login action, or the e
23RISK
open ↗
Referência
CVE-2017-6736
CVE-2017-6736HIGHunder attack
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabiliti
93RISK
open ↗
Referência
CVE-2017-6996
CVE-2017-6996—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO
23RISK
open ↗
Referência✓ VexDay Proof
Photo Cart 3.9 - 'adminprint.php' Remote File Inclusion
CVE-2006-6093—webappsphp
Multiple PHP remote file inclusion vulnerabilities in adminprint.php in PicturesPro Photo Cart 3.9 allow remote attacker
23RISK
open ↗
Referência
CVE-2026-16292
CVE-2026-16292MEDIUM
Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF
33RISK
open ↗
Referência
CVE-2026-13604
CVE-2026-13604MEDIUM
Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX
33RISK
open ↗
Referência
CVE-2026-82689
CVE-2026-82689CRITICAL
D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection
48RISK
open ↗
Referência
CVE-2026-82679
CVE-2026-82679MEDIUM
diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload
33RISK
open ↗
Referência
CVE-2017-15969
CVE-2017-15969—
PG All Share Video 1.0 allows SQL Injection via the PATH_INFO to search/tag, friends/index, users/profile, or video_cata
23RISK
open ↗
Referência
CVE-2017-6997
CVE-2017-6997—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO
23RISK
open ↗
Referência
CVE-2026-82688
CVE-2026-82688CRITICAL
D-Link DNS-340L/DNS-345 Virtual Volume virtual_vol.cgi os command injection
48RISK
open ↗
Referência
CVE-2026-82611
CVE-2026-82611MEDIUM
itsourcecode Online Medicine Delivery System Customer Login login.php cusAuthentication sql injection
33RISK
open ↗
← previouspage 360 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.