Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência✓ VexDay Proof
Travelsized CMS 0.4 - 'FrontPage.php' Remote File Inclusion
PHP remote file inclusion vulnerability in frontpage.php in Dan Jensen Travelsized CMS 0.4 and earlier allows remote att
23RISK
open ↗Referência
CVE-2026-78197
SourceCodester Simple Online Food Ordering System ajax.php save_user sql injection
33RISK
open ↗Referência✓ VexDay Proof
Ol BookMarks Manager 0.7.4 - SQL Injection
SQL injection vulnerability in read/index.php in ol'bookmarks 0.7.4 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência✓ VexDay Proof
Active Web Mail 4 - Authentication Bypass
SQL injection vulnerability in login.aspx in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗Referência
CVE-2019-11354
The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Ori
28RISK
open ↗Referência
CVE-2018-25302
Allok AVI to DVD SVCD VCD Converter 4.0.1217 Buffer Overflow SEH
41RISK
open ↗Referência
CVE-2026-7042
666ghj MiroFish REST API Endpoint __init__.py create_app missing authentication
33RISK
open ↗Referência
CVE-2026-7041
666ghj MiroFish Werkzeug Debugger PIN console information disclosure
33RISK
open ↗Referência
CVE-2026-6198
Tenda F456 NatStaticSetting fromNatStaticSetting stack-based overflow
41RISK
open ↗Referência
CVE-2015-7243
Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly
50RISK
open ↗Referência
CVE-2026-7038
tufantunc ssh-mcp Command Line index.ts insufficiently protected credentials
33RISK
open ↗Referência
CVE-2026-7037
Totolink A8000RU CGI cstecgi.cgi setVpnPassCfg os command injection
48RISK
open ↗Referência
CVE-2026-7127
SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
33RISK
open ↗Referência
CVE-2026-7118
code-projects Employee Management System cancel.php sql injection
33RISK
open ↗Referência
CVE-2026-7035
Tenda FH1202 httpd WrlclientSet fromWrlclientSet stack-based overflow
41RISK
open ↗Referência
CVE-2026-113393
DrayTek Vigor2960 commonupload mainfunction.cgi unrestricted upload
33RISK
open ↗Referência
CVE-2026-81660
Groundhogg < 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio Field
41RISK
open ↗Referência
CVE-2018-25312
LifeSize ClearSea 3.1.4 Directory Traversal Remote Code Execution
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.