Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2021-3018
ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the
43RISK
open ↗Referência
CVE-2026-8208
Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the re
41RISK
open ↗Referência
CVE-2011-5230
Multiple SQL injection vulnerabilities in the selectUserIdByLoginPass function in seotoaster_core/application/models/Log
23RISK
open ↗Referência
CVE-2026-14315
Pixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event Submission
33RISK
open ↗Referência✓ VexDay Proof
Pixaria Gallery 1.x - 'class.Smarty.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Pixaria Gallery before 1.4.3 allow remote attackers to execute arb
28RISK
open ↗Referência
CVE-2010-4566
The web authentication form in the NT4 authentication component in Citrix Access Gateway Enterprise Edition 9.2-49.8 and
43RISK
open ↗Referência
CVE-2016-4177
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632
28RISK
open ↗Referência
CVE-2026-7704
AV Stumpfl Pixera Two Media Server Service Port 1338 path traversal
33RISK
open ↗Referência
CVE-2026-7702
toeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization
33RISK
open ↗Referência
CVE-2026-7699
Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection
33RISK
open ↗Referência
CVE-2026-16250
Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload
48RISK
open ↗Referência
CVE-2026-7092
code-projects Invoice System in Laravel Profile profile improper authorization
33RISK
open ↗Referência
CVE-2026-7091
code-projects Invoice System in Laravel User Management user improper authorization
33RISK
open ↗Referência✓ VexDay Proof
SCO UnixWare < 7.1.4 p534589 - 'pkgadd' Local Privilege Escalation
Directory traversal vulnerability in pkgadd in SCO UnixWare 7.1.4 before p534589 allows local users to create or append
23RISK
open ↗Referência
CVE-2013-6627
net/http/http_stream_parser.cc in Google Chrome before 31.0.1650.48 does not properly process HTTP Informational (aka 1x
23RISK
open ↗Referência
WordPress Madara - Local File Inclusion
Madara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File Inclusion
68RISK
open ↗Referência
CVE-2026-7089
code-projects Home Service System Appointment Booking booking.php cross site scripting
33RISK
open ↗Referência
CVE-2026-7088
SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
33RISK
open ↗Referência
CVE-2026-7087
SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
33RISK
open ↗Referência
CVE-2026-7086
HBAI-Ltd Toonflow-app Storyboard Export replaceUrl.ts updateStoryboardUrl path traversal
33RISK
open ↗Referência
CVE-2026-7093
code-projects Invoice System in Laravel Invoice Endpoint invoice improper authorization
33RISK
open ↗Referência
CVE-2026-15525
kLOsk adloop write.py _validate_urls server-side request forgery
33RISK
open ↗Referência
CVE-2026-7085
HBAI-Ltd Toonflow-app downloadApp Endpoint downloadApp.ts z.url path traversal
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.