Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2010-2141
SQL injection vulnerability in index.php in NITRO Web Gallery allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência
CVE-2018-10814
Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials.
23RISK
open ↗Referência
CVE-2013-7057
Cross-site request forgery (CSRF) vulnerability in Axway SecureTransport 5.1 SP2 and earlier allows remote attackers to
23RISK
open ↗Referência
CVE-2016-1594
Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to read arbitrary attachments via a request
23RISK
open ↗Referência
CVE-2017-17621
Multivendor Penny Auction Clone Script 1.0 has SQL Injection via the PATH_INFO to the /detail URI.
23RISK
open ↗Referência
CVE-2020-15600
An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.
23RISK
open ↗Referência
CVE-2026-108923
1024-lab smart-admin Support Config Query queryByKey access control
33RISK
open ↗Referência
CVE-2026-109106
Polaris Office App Document Intake com.infraware.service.m.n.a path traversal
33RISK
open ↗Referência
CVE-2026-79630
WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution
33RISK
open ↗Referência
CVE-2026-19917
code-projects Online Food Order System delete_food_items1.php sql injection
33RISK
open ↗Referência
CVE-2009-3155
Cross-site scripting (XSS) vulnerability in gmap.php in the Almond Classifieds (com_aclassf) component 7.5 for Joomla! a
23RISK
open ↗Referência✓ VexDay Proof
S-CMS 1.1 Stable - Insecure Cookie Handling / Mass Page Delete
SQL injection vulnerability in admin/delete_page.php in S-Cms 1.1 Stable allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência
CVE-2017-17622
Online Exam Test Application Script 1.6 has SQL Injection via the exams.php sort parameter.
23RISK
open ↗Referência
CVE-2026-6433
Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE
56RISK
open ↗Referência
CVE-2018-10828
An issue was discovered in Alps Pointing-device Driver 10.1.101.207. ApMsgFwd.exe allows the current user to map and wri
23RISK
open ↗Referência
CVE-2017-1000366
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin
23RISK
open ↗Referência
CVE-2026-16992
Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication
33RISK
open ↗Referência
CVE-2026-109188
jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints
33RISK
open ↗Referência
CVE-2026-108882
JeecgBoot through 3.9.5 Missing Authorization via /sys/position/removePositionUser
33RISK
open ↗Referência
CVE-2025-34089
Remote for Mac Unauthenticated Remote Code Execution via AppleScript Injection
63RISK
open ↗Referência
CVE-2025-34089
Remote for Mac Unauthenticated Remote Code Execution via AppleScript Injection
63RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.