Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2010-4398
CVE-2010-4398HIGHunder attack
Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Wi
71RISK
open ↗
Referência
CVE-2026-14839
CVE-2026-14839HIGH
Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure
41RISK
open ↗
Referência
CVE-2010-4598
CVE-2010-4598—
Directory traversal vulnerability in Ecava IntegraXor 3.6.4000.0 and earlier allows remote attackers to read arbitrary f
28RISK
open ↗
Referência
CVE-2026-7733
CVE-2026-7733MEDIUM
funadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted upload
33RISK
open ↗
Referência
CVE-2026-7731
CVE-2026-7731MEDIUM
code-projects BloodBank Managing System get_state.php sql injection
33RISK
open ↗
Referência
CVE-2010-4995
CVE-2010-4995—
SQL injection vulnerability in the NeoRecruit (com_neorecruit) component 1.6.4 for Joomla! allows remote attackers to ex
23RISK
open ↗
Referência
CVE-2026-7714
CVE-2026-7714MEDIUM
crocodilestick Calibre-Web-Automated Admin Endpoint cwa_functions.py missing authentication
33RISK
open ↗
Referência
CVE-2026-7707
CVE-2026-7707MEDIUM
Open5GS UDR nudr-handler.c udr_nudr_dr_handle_subscription_context denial of service
33RISK
open ↗
Referência
CVE-2026-7706
CVE-2026-7706MEDIUM
Open5GS AMF gmm-handler.c gmm_handle_service_request denial of service
33RISK
open ↗
Referência
CVE-2025-15609
CVE-2025-15609HIGH
Fortis For WooCommerce < 1.3.1 - Sensitive API Key Disclosure
41RISK
open ↗
Referência
CVE-2021-30044
CVE-2021-30044—
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php.
23RISK
open ↗
Referência✓ VexDay Proof
PHPMyRing 4.2.0 - 'view_com.php' SQL Injection
CVE-2006-4114—webappsphp
SQL injection vulnerability in view_com.php in Nicolas Grandjean PHPMyRing 4.2.0 and earlier allows remote attackers to
23RISK
open ↗
Referência
CVE-2021-30150
CVE-2021-30150—
Composr 10.0.36 allows XSS in an XML script.
23RISK
open ↗
Referência
CVE-2021-3018
CVE-2021-3018—
ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the
43RISK
open ↗
Referência
CVE-2026-8208
CVE-2026-8208HIGH
Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the re
41RISK
open ↗
Referência
CVE-2011-5230
CVE-2011-5230—
Multiple SQL injection vulnerabilities in the selectUserIdByLoginPass function in seotoaster_core/application/models/Log
23RISK
open ↗
Referência
CVE-2026-14315
CVE-2026-14315MEDIUM
Pixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event Submission
33RISK
open ↗
Referência✓ VexDay Proof
Pixaria Gallery 1.x - 'class.Smarty.php' Remote File Inclusion
CVE-2007-2458—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Pixaria Gallery before 1.4.3 allow remote attackers to execute arb
28RISK
open ↗
Referência
CVE-2010-4566
CVE-2010-4566—
The web authentication form in the NT4 authentication component in Citrix Access Gateway Enterprise Edition 9.2-49.8 and
43RISK
open ↗
Referência
CVE-2016-4177
CVE-2016-4177—
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632
28RISK
open ↗
Referência
CVE-2026-7705
CVE-2026-7705MEDIUM
JD Cloud JDCOS Service jdcap set_iptv_info command injection
33RISK
open ↗
Referência
CVE-2026-5335
CVE-2026-5335MEDIUM
Magic Export & Import < 1.2.0 - Unauthenticated PII Disclosure
33RISK
open ↗
Referência
CVE-2026-7704
CVE-2026-7704MEDIUM
AV Stumpfl Pixera Two Media Server Service Port 1338 path traversal
33RISK
open ↗
Referência
CVE-2026-7703
CVE-2026-7703MEDIUM
AV Stumpfl Pixera Two Media Server Websocket API code injection
33RISK
open ↗
Referência
CVE-2026-7702
CVE-2026-7702MEDIUM
toeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization
33RISK
open ↗
Referência
CVE-2026-7699
CVE-2026-7699MEDIUM
Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection
33RISK
open ↗
Referência
CVE-2026-16250
CVE-2026-16250CRITICAL
Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload
48RISK
open ↗
Referência
CVE-2026-15543
CVE-2026-15543HIGH
Tenda CH22 CertListInfo formCertListInfo buffer overflow
41RISK
open ↗
Referência
CVE-2026-7092
CVE-2026-7092MEDIUM
code-projects Invoice System in Laravel Profile profile improper authorization
33RISK
open ↗
Referência
CVE-2026-7091
CVE-2026-7091MEDIUM
code-projects Invoice System in Laravel User Management user improper authorization
33RISK
open ↗
← previouspage 499 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.