Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
Microsoft Windows Server 2016 - Win32k Elevation of Privilege
CVE-2023-29336HIGHunder attacklocalwindows
Win32k Elevation of Privilege Vulnerability
83RISK
open ↗
Referência
CVE-2012-5348
CVE-2012-5348—
SQL injection vulnerability in MangosWeb Enhanced 3.0.3 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência
CVE-2022-50970
CVE-2022-50970MEDIUM
WordPress Plugin AAWP 3.16 Reflected XSS via tab Parameter
33RISK
open ↗
Referência
CVE-2026-111230
CVE-2026-111230MEDIUM
Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL
33RISK
open ↗
Referência
CVE-2026-111228
CVE-2026-111228MEDIUM
Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php
33RISK
open ↗
Referência
CVE-2012-5387
CVE-2012-5387—
Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordP
23RISK
open ↗
Referência
CVE-2012-5900
CVE-2012-5900—
Multiple SQL injection vulnerabilities in SAMEDIA LandShop 0.9.2 allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência
CVE-2014-2623
CVE-2014-2623—
Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown
60RISK
open ↗
Referência
CVE-2023-33584
CVE-2023-33584CRITICAL
Sourcecodester Enrollment System Project V1.0 is vulnerable to SQL Injection (SQLI) attacks, which allow an attacker to
53RISK
open ↗
Referência
CVE-2023-34581
CVE-2023-34581—
Sourcecodester Service Provider Management System v1.0 is vulnerable to SQL Injection via the ID parameter in /php-spms/
23RISK
open ↗
Referência
CVE-2008-2335
CVE-2008-2335—
Cross-site scripting (XSS) vulnerability in search_results.php in Vastal I-Tech phpVID 1.1 and 1.2 allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
cPanel WebHost Manager (WHM) - '/webmail/x3/mail/clientconf.html?acct' Cross-Site Scripting
CVE-2012-6448—webappsphp
Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web scrip
23RISK
open ↗
Referência
CVE-2026-76050
CVE-2026-76050MEDIUM
SourceCodester Simple Online Food Ordering System ajax.php delete_menu sql injection
33RISK
open ↗
Referência
CVE-2018-7289
CVE-2018-7289—
An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames cont
23RISK
open ↗
Referência
CVE-2015-4481
CVE-2015-4481—
Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Win
23RISK
open ↗
Referência✓ VexDay Proof
PHPRaider 1.0.7 - 'PHPbb3.functions.php' Remote File Inclusion
CVE-2008-2481—webappsphp
PHP remote file inclusion vulnerability in authentication/phpbb3/phpbb3.functions.php in phpRaider 1.0.7 and 1.0.7a, whe
23RISK
open ↗
Referência
CVE-2015-7084
CVE-2015-7084—
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to g
23RISK
open ↗
Referência
CVE-2025-55315
CVE-2025-55315CRITICAL
ASP.NET Security Feature Bypass Vulnerability
60RISK
open ↗
Referência✓ VexDay Proof
Xomol CMS 1.2 - Authentication Bypass / Local File Inclusion
CVE-2008-2483—webappsphp
Directory traversal vulnerability in index.php in Xomol CMS 1.20071213 allows remote attackers to include and execute ar
23RISK
open ↗
Referência
CVE-2015-7110
CVE-2015-7110—
The Disk Images component in Apple OS X before 10.11.2 and tvOS before 9.1 allows local users to gain privileges or caus
23RISK
open ↗
Referência
CVE-2018-7477
CVE-2018-7477—
SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/
23RISK
open ↗
Referência
CVE-2026-41473
CVE-2026-41473HIGH
CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints
41RISK
open ↗
Referência
CVE-2026-41472
CVE-2026-41472MEDIUM
CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard
33RISK
open ↗
Referência
CVE-2026-41414
CVE-2026-41414HIGH
Skim: Arbitrary code execution via pull_request_target fork checkout in pr.yml
41RISK
open ↗
Referência
CVE-2026-39920
CVE-2026-39920CRITICAL
BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE
48RISK
open ↗
Referência
CVE-2026-31635
CVE-2026-31635HIGH
rxrpc: fix oversized RESPONSE authenticator length check
41RISK
open ↗
Referência
CVE-2026-6981
CVE-2026-6981MEDIUM
IhateCreatingUserNames2 AiraHub2 Endpoint AiraHub.py sync_agents server-side request forgery
33RISK
open ↗
Referência
CVE-2026-6980
CVE-2026-6980MEDIUM
Divyanshu-hash GitPilot-MCP main.py repo_path command injection
33RISK
open ↗
Referência
CVE-2026-6979
CVE-2026-6979MEDIUM
devlikeapro WAHA API Request media.controller.ts server-side request forgery
33RISK
open ↗
Referência
CVE-2026-6978
CVE-2026-6978MEDIUM
JiZhiCMS addcache.html htmlspecialchars_decode sql injection
33RISK
open ↗
← previouspage 500 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.