Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2026-8378
CVE-2026-8378MEDIUM
Frontend File Manager Plugin <= 23.6 - Subscriber+ Stored Cross-Site Scripting via File Rename
33RISK
open ↗
Referência
CVE-2017-16807
CVE-2017-16807—
A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exist
23RISK
open ↗
Referência
CVE-2026-56788
CVE-2026-56788MEDIUM
RTKLIB 2.4.3 - Out-of-bounds Read via Negative Array Index in getcodepri
33RISK
open ↗
Referência
CVE-2019-3398
CVE-2019-3398HIGHunder attack
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote at
100RISK
open ↗
Referência
CVE-2026-81429
CVE-2026-81429HIGH
Export & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRF
41RISK
open ↗
Referência
CVE-2026-12811
CVE-2026-12811MEDIUM
kortix-ai suna Auth Endpoint page.tsx router.push cross site scripting
33RISK
open ↗
Referência✓ VexDay Proof
fipsGallery 1.5 - 'index1.asp' SQL Injection
CVE-2006-6117—webappsasp
SQL injection vulnerability in index1.asp in fipsGallery 1.5 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2026-77752
CVE-2026-77752HIGH
Temporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege Escalation
41RISK
open ↗
Referência✓ VexDay Proof
Sisfo Kampus 0.8 - Remote File Inclusion / Download
CVE-2006-6137—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Sisfo Kampus 0.8 allow remote attackers to execute arbitrary PHP c
23RISK
open ↗
Referência
CVE-2012-5864
CVE-2012-5864—
Sinapsi eSolar Improper Authentication
48RISK
open ↗
Referência
CVE-2026-77705
CVE-2026-77705HIGH
Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover
41RISK
open ↗
Referência
CVE-2012-6039
CVE-2012-6039—
SQL injection vulnerability in view_comments.php in YABSoft Advanced Image Hosting (AIH) Script, possibly 2.3, allows re
23RISK
open ↗
Referência
CVE-2026-8071
CVE-2026-8071HIGH
Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass
41RISK
open ↗
Referência✓ VexDay Proof
JiRos FAQ Manager 1.0 - 'index.asp' SQL Injection
CVE-2006-6149—webappsphp
SQL injection vulnerability in index.asp in JiRos FAQ Manager 1.0 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência
CVE-2016-20065
CVE-2016-20065HIGH
Product Catalog 8 1.2 Plugin WordPress SQL Injection
41RISK
open ↗
Referência
CVE-2026-4986
CVE-2026-4986MEDIUM
WPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook Forgery
33RISK
open ↗
Referência
CVE-2018-11646
CVE-2018-11646—
webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFavicon
50RISK
open ↗
Referência
CVE-2026-12208
CVE-2026-12208MEDIUM
jsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollution
33RISK
open ↗
Referência
CVE-2026-12207
CVE-2026-12207MEDIUM
medkey-org medkey HTTP REST API PatientController.php actionGetPatientById resource injection
33RISK
open ↗
Referência
CVE-2026-12201
CVE-2026-12201MEDIUM
IObit Malware Fighter DLL permission
33RISK
open ↗
Referência
CVE-2018-1201
CVE-2018-1201—
Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and vers
23RISK
open ↗
Referência
CVE-2026-11556
CVE-2026-11556HIGH
Tenda F451 Web Management WriteFacMac formWriteFacMac os command injection
41RISK
open ↗
Referência
CVE-2019-7440
CVE-2019-7440—
JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_S
23RISK
open ↗
Referência
CVE-2019-7440
CVE-2019-7440—
JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_S
23RISK
open ↗
Referência
CVE-2026-11620
CVE-2026-11620MEDIUM
TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation
33RISK
open ↗
Referência
CVE-2026-11618
CVE-2026-11618MEDIUM
DTStack Taier Source Connection Test Endpoint LoginInterceptor.java preHandle improper authentication
33RISK
open ↗
Referência
CVE-2014-8948
CVE-2014-8948—
Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows re
23RISK
open ↗
Referência
CVE-2014-8949
CVE-2014-8949—
The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitr
23RISK
open ↗
Referência
CVE-2018-19276
CVE-2018-19276CRITICAL
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated use
85RISK
open ↗
Referência
CVE-2014-9632
CVE-2014-9632—
The TDI driver (avgtdix.sys) in AVG Internet Security before 2013.3495 Hot Fix 18 and 2015.x before 2015.5315 and Protec
23RISK
open ↗
← previouspage 453 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.