Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2026-15536
itsourcecode Hospital Management System patviewprescription.php sql injection
33RISK
open ↗Referência
CVE-2019-1937
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability
85RISK
open ↗Referência
CVE-2019-19509
An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a
60RISK
open ↗Referência
CVE-2020-11698
An issue was discovered in Titan SpamTitan 7.07. Improper input sanitization of the parameter community on the page snmp
60RISK
open ↗Referência✓ VexDay Proof
Mambo Component Sitemap 2.0.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in sitemap.xml.php in Sitemap component (com_sitemap) 2.0.0 for Mambo 4.5.1 CMS,
23RISK
open ↗Referência
CVE-2026-86281
SourceCodester Syllabus-Aligned Learning Management & Examination System cross-site request forgery
33RISK
open ↗Referência
PandoraFMS 7.0 NG 746 - Persistent Cross-Site Scripting
Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator
28RISK
open ↗Referência
CVE-2026-101142
Eleveo Quality Management Questionnaire Audio Upload Scorecard.jsp path traversal
33RISK
open ↗Referência
CVE-2026-10231
Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp extract_anim_value heap-based overflow
33RISK
open ↗Referência
CVE-2026-10229
Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_meshes heap-based overflow
33RISK
open ↗Referência
CVE-2026-10228
raisulislamg4 student_management_system_by_php admission_form_check.php cross site scripting
33RISK
open ↗Referência
CVE-2026-10227
raisulislamg4 student_management_system_by_php User Creation add_user_check.php sql injection
33RISK
open ↗Referência
CVE-2021-40381
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. index_MJpeg.cgi allows
28RISK
open ↗Referência✓ VexDay Proof
MyBloggie 2.1.4 - 'trackback.php' Multiple SQL Injections
Multiple SQL injection vulnerabilities in trackback.php in myWebland myBloggie 2.1.4 and earlier allow remote attackers
23RISK
open ↗Referência
CVE-2021-40382
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. mjpegStreamer.cgi allo
28RISK
open ↗Referência
CVE-2026-12492
Happy Coders OTP Login for WooCommerce < 2.8 - Unauthenticated Account Takeover via hcotp_auto_login_user
48RISK
open ↗Referência
CVE-2026-15752
zhinianboke xianyu-auto-reply Backend User Endpoint users authorization
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.