Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,533cataloged exploits
35,607CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,407GitHub PoC 14,247VulnCheck XDB 8,663Nuclei 4,287Metasploit 3,474✓ verified onlyrecentpopularrisk
22,407 exploits
Referência
CVE-2026-8935
Advanced Google Maps < 6.1.1 - Unauthenticated Administrator Account Creation
48RISK
open ↗Referência
CVE-2026-8386
WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker ID
48RISK
open ↗Referência
CVE-2017-20251
WordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST API
48RISK
open ↗Referência
CVE-2026-25856
OpenBullet2 0.3.2 Authenticated RCE via Job Configuration Interface
41RISK
open ↗Referência
CVE-2026-11529
designcomputer mysql-mcp-server mysql URI server.py read_resource sql injection
33RISK
open ↗Referência
CVE-2019-18818
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s
60RISK
open ↗Referência
CVE-2026-67611
OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
41RISK
open ↗Referência
CVE-2026-39932
OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection
48RISK
open ↗Referência
CVE-2026-13714
Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
48RISK
open ↗Referência
CVE-2026-13390
The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation
33RISK
open ↗Referência
CVE-2026-13332
Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)
48RISK
open ↗Referência
CVE-2026-13152
Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation
41RISK
open ↗Referência
CVE-2026-12493
Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order
41RISK
open ↗Referência
CVE-2026-12981
CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset
41RISK
open ↗Referência
CVE-2026-12877
Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter
48RISK
open ↗Referência
CVE-2026-12690
ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization
28RISK
open ↗Referência
CVE-2026-65010
Datasets Symlink-following Arbitrary File Write via Extractor.extract()
33RISK
open ↗Referência
CVE-2026-63765
Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation
41RISK
open ↗Referência
CVE-2026-16490
itsourcecode Hospital Management System prescription.php sql injection
33RISK
open ↗Referência
CVE-2026-15752
zhinianboke xianyu-auto-reply Backend User Endpoint users authorization
33RISK
open ↗Referência
CVE-2026-15471
Eleveo Call Recording Software pci_dss_status.jsp improper authorization
33RISK
open ↗Referência
CVE-2026-16073
AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross site scripting
33RISK
open ↗Referência
CVE-2026-12492
Happy Coders OTP Login for WooCommerce < 2.8 - Unauthenticated Account Takeover via hcotp_auto_login_user
48RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.