Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,151cataloged exploits
35,370CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,233GitHub PoC 14,119VulnCheck XDB 8,617Nuclei 4,257Metasploit 3,474✓ verified onlyrecentpopularrisk
22,233 exploits
Referência
CVE-2026-14858
WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR
33RISK
open ↗Referência
CVE-2026-14857
WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR
23RISK
open ↗Referência
CVE-2026-13613
KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint
41RISK
open ↗Referência
CVE-2026-13612
KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR
23RISK
open ↗Referência
CVE-2026-13177
Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR
23RISK
open ↗Referência
CVE-2026-13171
Eventin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint
41RISK
open ↗Referência
CVE-2026-13168
Eventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API
33RISK
open ↗Referência
CVE-2026-12976
LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant
33RISK
open ↗Referência
CVE-2025-15687
Open5GS SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb denial of service
33RISK
open ↗Referência
CVE-2026-13493
AIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation_api.py resource injection
28RISK
open ↗Referência
CVE-2026-13491
78 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service
33RISK
open ↗Referência
CVE-2026-13489
78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization
28RISK
open ↗Referência
CVE-2026-13488
SourceCodester Class and Exam Timetabling System preview7.php sql injection
33RISK
open ↗Referência
CVE-2026-13487
SourceCodester Class and Exam Timetabling System archive.php sql injection
33RISK
open ↗Referência
CVE-2026-11437
perfree go-fastdfs-web Installation Endpoint checkServer server-side request forgery
33RISK
open ↗Referência
CVE-2026-11408
vertex-app vertex Log Viewer Endpoint LogMod.js os command injection
33RISK
open ↗Referência
CVE-2026-11338
SourceCodester Ship Ferry Ticket Reservation System manage_user cross site scripting
33RISK
open ↗Referência
CVE-2026-11337
tittuvarghese CollegeManagementSystem fetch.php cross site scripting
33RISK
open ↗Referência
CVE-2026-11336
tittuvarghese CollegeManagementSystem Admin admin_page.php improper authorization
33RISK
open ↗Referência
CVE-2026-11335
tittuvarghese CollegeManagementSystem login-form.php session_start session fixiation
33RISK
open ↗Referência
CVE-2004-1722
SQL injection vulnerability in calendar.html in Merak Mail Server 5.2.7 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência
CVE-2026-69114
Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass
41RISK
open ↗Referência
CVE-2026-69114
Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.