Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-8123
CVE-2026-8123MEDIUM
Open5GS NSSF message.c ogs_sbi_discovery_option_add_snssais denial of service
33RISK
open ↗
Referência
CVE-2026-8122
CVE-2026-8122MEDIUM
Open5GS NSSF message.c ogs_sbi_discovery_option_add_service_names denial of service
33RISK
open ↗
Referência
CVE-2026-71511
CVE-2026-71511HIGH
Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints
41RISK
open ↗
Referência✓ VexDay Proof
Forum82 < 2.5.2b - 'repertorylevel' Multiple File Inclusions
CVE-2006-5148—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Forum82 2.5.2b and earlier allow remote attackers to execute arbit
23RISK
open ↗
Referência
CVE-2026-10302
CVE-2026-10302MEDIUM
itsourcecode Fees Management System manage_fee.php sql injection
33RISK
open ↗
Referência✓ VexDay Proof
Chicomas 2.0.4 - Database Backup / File Disclosure / Cross-Site Scripting
CVE-2008-5853—webappsphp
Chilek Content Management System (aka ChiCoMaS) 2.0.4 and earlier stores sensitive information under the web root with i
23RISK
open ↗
Referência
CVE-2014-5301
CVE-2014-5301—
Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 t
60RISK
open ↗
Referência
CVE-2014-5301
CVE-2014-5301—
Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 t
60RISK
open ↗
Referência
CVE-2014-10034
CVE-2014-10034—
Multiple SQL injection vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to execut
23RISK
open ↗
Referência
CVE-2014-10034
CVE-2014-10034—
Multiple SQL injection vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to execut
23RISK
open ↗
Referência
CVE-2026-12129
CVE-2026-12129MEDIUM
CodeAstro Human Resource Management System Dashboard add_tod cross site scripting
33RISK
open ↗
Referência
CVE-2019-25746
CVE-2019-25746HIGH
WordPress Sliced Invoices 3.8.2 SQL Injection via post Parameter
41RISK
open ↗
Referência
CVE-2026-24067
CVE-2026-24067HIGH
Slate Digital Connect macOS XPC PID validation privilege escalation
41RISK
open ↗
Referência
CVE-2025-71319
CVE-2025-71319HIGH
image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser
41RISK
open ↗
Referência✓ VexDay Proof
FAQ Manager 1.2 - 'categorie.php' SQL Injection
CVE-2008-5287—webappsphp
SQL injection vulnerability in catagorie.php in Werner Hilversum FAQ Manager 1.2 allows remote attackers to execute arbi
23RISK
open ↗
Referência★ 14
watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523
CVE-2026-10520CRITICALunder attack
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote
100RISK
open ↗
Referência✓ VexDay Proof
mini-pub 0.3 - Local Directory Traversal / File Disclosure
CVE-2008-5936—webappsphp
front-end/edit.php in mini-pub 0.3 and earlier allows remote attackers to read files and obtain PHP source code via a fi
23RISK
open ↗
Referência
CVE-2026-65053
CVE-2026-65053MEDIUM
Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name
33RISK
open ↗
Referência✓ VexDay Proof
template creature - SQL Injection / File Disclosure
CVE-2008-5951—webappsphp
ASP Template Creature stores sensitive information under the web root with insufficient access control, which allows rem
23RISK
open ↗
Referência
CVE-2016-20068
CVE-2016-20068HIGH
WordPress Booking Calendar Contact Form 1.0.23 SQL Injection
41RISK
open ↗
Referência
CVE-2015-6100
CVE-2015-6100—
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wi
23RISK
open ↗
Referência
CVE-2015-6128
CVE-2015-6128—
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle library loading, which allo
60RISK
open ↗
Referência
CVE-2026-14704
CVE-2026-14704MEDIUM
stephen-kruger bluebox cross site scripting
33RISK
open ↗
Referência
CVE-2026-14638
CVE-2026-14638MEDIUM
itsourcecode Hospital Management System patient.php sql injection
33RISK
open ↗
Referência
CVE-2026-14637
CVE-2026-14637HIGH
kirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserialization
41RISK
open ↗
Referência
CVE-2026-22681
CVE-2026-22681HIGH
OpenViking < 0.3.4 SSRF via /api/v1/resources
41RISK
open ↗
Referência
CVE-2019-3929
CVE-2019-3929CRITICALunder attack
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Ba
100RISK
open ↗
Referência
CVE-2026-10171
CVE-2026-10171MEDIUM
code-projects Online Music Site AdminUpdateAlbum.php sql injection
33RISK
open ↗
Referência
CVE-2017-20247
CVE-2017-20247HIGH
WordPress Plugin PICA Photo Gallery 1.0 SQL Injection
41RISK
open ↗
Referência
CVE-2026-49494
CVE-2026-49494HIGH
Xcitium Client Security / Comodo Internet Security Remote Denial of Service
41RISK
open ↗
← previouspage 510 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.