Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-6200
Tenda F456 webtypelibrary formwebtypelibrary stack-based overflow
41RISK
open ↗Referência
CVE-2016-8811
For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3
23RISK
open ↗Referência
CVE-2014-4511
Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in
60RISK
open ↗Referência
CVE-2015-1028
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remo
23RISK
open ↗Referência
CVE-2022-38580
Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).
53RISK
open ↗Referência✓ VexDay Proof
GrapAgenda 0.1 - 'page' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in GrapAgenda 0.11 and earlier, when register_globals is enabled, a
23RISK
open ↗Referência✓ VexDay Proof
Danneo CMS 0.5.1 - Blind SQL Injection
SQL injection vulnerability in index.php in Danneo CMS 0.5.1 and earlier, when the Referers statistics option is enabled
23RISK
open ↗Referência
CVE-2011-5277
Multiple SQL injection vulnerabilities in signature.php in the Advanced Forum Signatures (aka afsignatures) plugin 2.0.4
23RISK
open ↗Referência
CVE-2026-5854
Totolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injection
53RISK
open ↗Referência
CVE-2026-5853
Totolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injection
53RISK
open ↗Referência
CVE-2026-5850
Totolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injection
53RISK
open ↗Referência
CVE-2026-5848
jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injection
33RISK
open ↗Referência
CVE-2026-22683
Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE
56RISK
open ↗Referência
CVE-2026-22683
Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE
56RISK
open ↗Referência
CVE-2026-22679
Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint
53RISK
open ↗Referência
CVE-2026-7392
SourceCodester Pharmacy Sales and Inventory System ajax.php delete_supplier sql injection
33RISK
open ↗Referência
CVE-2026-7391
SourceCodester Pharmacy Sales and Inventory System ajax.php save_supplier sql injection
33RISK
open ↗Referência
CVE-2026-7390
SourceCodester Pharmacy Sales and Inventory System index.php customer cross site scripting
33RISK
open ↗Referência
CVE-2026-7388
EyouCMS Template File FilemanagerLogic.php editFile code injection
33RISK
open ↗Referência✓ VexDay Proof
Neat weblog 0.2 - 'articleId' SQL Injection
SQL injection vulnerability in index.php in Neat weblog 0.2 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.