Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-42785
OpenKM 6.3.12 Remote Code Execution via Administrative Scripting
41RISK
open ↗Referência
CVE-2010-4997
SQL injection vulnerability in index.php in OlyKit Swoopo Clone 2010 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência
CVE-2026-18723
diaowen DWSurvey Survey Status up-survey-status.do improper authorization
33RISK
open ↗Referência
CVE-2014-3544
Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before
23RISK
open ↗Referência
CVE-2014-5276
Multiple cross-site scripting (XSS) vulnerabilities in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated u
23RISK
open ↗Referência
CVE-2014-3631
The assoc_array_gc function in the associative-array implementation in lib/assoc_array.c in the Linux kernel before 3.16
23RISK
open ↗Referência
CVE-2026-11581
Kali Forms < 2.4.13 - Contributor+ Stored XSS via Form Field Caption
33RISK
open ↗Referência
CVE-2016-7255
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,
93RISK
open ↗Referência
CVE-2018-11646
webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFavicon
50RISK
open ↗Referência
CVE-2026-13534
CherryHQ cherry-studio CherryIN Preload API MemoryService.ts sha256 authorization
28RISK
open ↗Referência
CVE-2026-42284
GitPython: Unsafe option check validates multi_options before shlex.split transforms it
41RISK
open ↗Referência
CVE-2026-8083
SourceCodester Pharmacy Sales and Inventory System ajax.php save_user sql injection
33RISK
open ↗Referência
CVE-2026-56789
RTKLIB 2.4.3 - Heap Buffer Overflow and Stack Read via Oversized RINEX Epoch Satellite Count
41RISK
open ↗Referência
CVE-2026-15672
itsourcecode Electronic Judging System add_judges.php sql injection
33RISK
open ↗Referência
CVE-2026-10298
ggml-org whisper.cpp ggml.c whisper_model_load null pointer dereference
33RISK
open ↗Referência
CVE-2026-56787
RTKLIB 2.4.3 - Off-by-One Out-of-Bounds Read in decode_ssr3 via RTCM3 SSR Message
33RISK
open ↗Referência
CVE-2021-47931
Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication
33RISK
open ↗Referência
CVE-2022-1175
Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 befor
63RISK
open ↗Referência
CVE-2026-15669
louisho5 picobot exec Tool exec.go ExecTool.Execute os command injection
33RISK
open ↗Referência
CVE-2016-6256
SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML
23RISK
open ↗Referência
CVE-2010-2846
Cross-site scripting (XSS) vulnerability in the InterJoomla ArtForms (com_artforms) component 2.1b7.2 RC2 for Joomla! al
23RISK
open ↗Referência
CVE-2016-6256
SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.