Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2016-0709
CVE-2016-0709—
Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3
60RISK
open ↗
Referência
CVE-2026-7003
CVE-2026-7003MEDIUM
WIT SynApps Runtime 1.4.11 Hardcoded OAuth Credentials Disclosure
33RISK
open ↗
Referência
CVE-2026-119620
CVE-2026-119620MEDIUM
37954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload
33RISK
open ↗
Referência
CVE-2026-119763
CVE-2026-119763MEDIUM
changelog.com before commit 7b35e829 Missing Authorization via Preview Routes
33RISK
open ↗
Referência
CVE-2026-119619
CVE-2026-119619MEDIUM
37954679 cak-filemanagement-system save_student.php mysqli_query sql injection
33RISK
open ↗
Referência
CVE-2016-0953
CVE-2016-0953—
Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to exec
28RISK
open ↗
Referência
CVE-2018-15139
CVE-2018-15139—
Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote
28RISK
open ↗
Referência
CVE-2018-16763
CVE-2018-16763—
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca
60RISK
open ↗
Referência
CVE-2026-82125
CVE-2026-82125MEDIUM
Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOR
33RISK
open ↗
Referência
CVE-2018-20220
CVE-2018-20220—
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authen
28RISK
open ↗
Referência
CVE-2018-20556
CVE-2018-20556—
SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary
28RISK
open ↗
Referência
CVE-2026-91855
CVE-2026-91855MEDIUM
Open5GS PFCP Message handler.c denial of service
33RISK
open ↗
Referência
CVE-2018-18858
CVE-2018-18858—
Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS.
23RISK
open ↗
Referência
CVE-2024-58385
CVE-2024-58385CRITICAL
Yonyou U8 CRM SQL Injection via fillbacksettingedit.php
48RISK
open ↗
Referência
CVE-2026-82124
CVE-2026-82124MEDIUM
Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output
33RISK
open ↗
Referência
CVE-2026-78474
CVE-2026-78474MEDIUM
Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated Order and Customer Data Disclosure via 'btn_print' Parameter
33RISK
open ↗
Referência
CVE-2026-77702
CVE-2026-77702MEDIUM
Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token
33RISK
open ↗
Referência✓ VexDay Proof
Crafty Syntax Image Gallery 3.1g - Remote Code Execution
CVE-2006-1667—webappsphp
SQL injection vulnerability in slides.php in Eric Gerdes Crafty Syntax Image Gallery (CSIG) (aka PHP thumbnail Photo Gal
23RISK
open ↗
Referência
CVE-2023-54398
CVE-2023-54398CRITICAL
Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet
48RISK
open ↗
Referência
CVE-2023-54398
CVE-2023-54398CRITICAL
Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet
48RISK
open ↗
Referência✓ VexDay Proof
PHP Simple Shop 2.0 - 'abs_path' Remote File Inclusion
CVE-2006-4052—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools PHP Simple Shop 2.0 and earlier allow remote att
28RISK
open ↗
Referência
CVE-2026-76559
CVE-2026-76559MEDIUM
WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL Handling
33RISK
open ↗
Referência✓ VexDay Proof
PHPSherpa - '/include/config.inc.php' Remote File Inclusion
CVE-2007-0495—webappsphp
PHP remote file inclusion vulnerability in include/config.inc.php in PhpSherpa allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
PhotoFiltre Studio 8.1.1 - '.tif' Local Buffer Overflow
CVE-2007-2192—localwindows
Buffer overflow in Photofiltre Studio 8.1.1 allows user-assisted remote attackers to execute arbitrary code via a crafte
23RISK
open ↗
Referência
CVE-2016-1106
CVE-2016-1106—
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsof
35RISK
open ↗
Referência
CVE-2016-1524
CVE-2016-1524—
Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote
60RISK
open ↗
Referência
CVE-2016-1525
CVE-2016-1525—
Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allow
60RISK
open ↗
Referência
CVE-2016-1719
CVE-2016-1719—
The IOHIDFamily API in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain pri
23RISK
open ↗
Referência
CVE-2026-60121
CVE-2026-60121CRITICAL
Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.php
48RISK
open ↗
Referência
CVE-2017-9810
CVE-2017-9810—
There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Mai
23RISK
open ↗
← previouspage 362 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.