Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,620cataloged exploits
35,647CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,429GitHub PoC 14,270VulnCheck XDB 8,693Nuclei 4,299Metasploit 3,474✓ verified onlyrecentpopularrisk
22,429 exploits
Referência
CVE-2026-11344
CVE-2026-11344MEDIUM
code-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted upload
33RISK
open ↗
Referência
CVE-2026-11342
CVE-2026-11342MEDIUM
code-projects Hotel and Tourism Reservation System details.php sql injection
33RISK
open ↗
Referência
CVE-2021-47955
CVE-2021-47955MEDIUM
CouchCMS 2.2.1 Cross-Site Scripting via SVG File Upload
33RISK
open ↗
Referência
CVE-2021-47954
CVE-2021-47954HIGH
LayerBB 1.1.4 SQL Injection via search_query Parameter
41RISK
open ↗
Referência
CVE-2020-37228
CVE-2020-37228CRITICAL
iDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security Bypass
48RISK
open ↗
Referência
CVE-2020-37227
CVE-2020-37227HIGH
WordPress Plugin HS Brand Logo Slider 2.1 Unrestricted File Upload
41RISK
open ↗
Referência
CVE-2018-25336
CVE-2018-25336MEDIUM
jCart for OpenCart 2.3.0.2 Cross-Site Request Forgery
33RISK
open ↗
Referência
CVE-2018-25335
CVE-2018-25335CRITICAL
WordPress Plugin Peugeot Music 1.0 Arbitrary File Upload
48RISK
open ↗
Referência
CVE-2018-25333
CVE-2018-25333HIGH
Nordex N149/4.0-4.5 Wind Turbine Web Server SQL Injection
41RISK
open ↗
Referência
CVE-2018-25332
CVE-2018-25332CRITICAL
GitBucket 4.23.1 Unauthenticated Remote Code Execution
48RISK
open ↗
Referência
CVE-2018-25331
CVE-2018-25331MEDIUM
Zenar Content Management System Cross-Site Scripting via ajax.php
33RISK
open ↗
Referência
CVE-2018-25330
CVE-2018-25330HIGH
Joomla! EkRishta 2.10 Persistent XSS and SQL Injection
41RISK
open ↗
Referência
CVE-2018-25329
CVE-2018-25329HIGH
WordPress Plugin WP with Spritz 1.0 Remote File Inclusion
41RISK
open ↗
Referência
CVE-2020-10220
CVE-2020-10220—
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php
60RISK
open ↗
Referência
CVE-2020-10220
CVE-2020-10220—
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php
60RISK
open ↗
Referência
CVE-2020-10220
CVE-2020-10220—
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php
60RISK
open ↗
Referência
CVE-2026-66731
CVE-2026-66731HIGH
facil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS
41RISK
open ↗
Referência
CVE-2026-66730
CVE-2026-66730HIGH
facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser
41RISK
open ↗
Referência
CVE-2026-66729
CVE-2026-66729HIGH
facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser
41RISK
open ↗
Referência
CVE-2025-9486
CVE-2025-9486LOW
Incorrect Privilege Assignment in GitLab
28RISK
open ↗
Referência
CVE-2026-4879
CVE-2026-4879MEDIUM
Missing Authorization in GitLab
33RISK
open ↗
Referência
CVE-2026-6821
CVE-2026-6821MEDIUM
Missing Authorization in GitLab
33RISK
open ↗
Referência
CVE-2026-15217
CVE-2026-15217HIGH
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
41RISK
open ↗
Referência
CVE-2026-15216
CVE-2026-15216HIGH
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
41RISK
open ↗
Referência
CVE-2026-16494
CVE-2026-16494HIGH
Missing Authorization in GitLab
41RISK
open ↗
Referência
CVE-2026-18433
CVE-2026-18433MEDIUM
Incorrect Authorization in GitLab
33RISK
open ↗
Referência
CVE-2026-7427
CVE-2026-7427MEDIUM
Allocation of Resources Without Limits or Throttling in GitLab
33RISK
open ↗
Referência
CVE-2026-69116
CVE-2026-69116MEDIUM
FlyEnv < 4.18.0 Cross-Site Scripting via v-html
33RISK
open ↗
Referência
CVE-2026-69114
CVE-2026-69114HIGH
Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass
41RISK
open ↗
Referência
CVE-2026-18470
CVE-2026-18470HIGH
Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response
41RISK
open ↗
← previouspage 506 / 748next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.