Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2018-11671
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php
23RISK
open ↗Referência
CVE-2026-84289
NousResearch hermes-agent MCP Tool mcp_tool.py list_tools memory allocation
33RISK
open ↗Referência
CVE-2026-7377
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
41RISK
open ↗Referência
CVE-2026-7481
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
41RISK
open ↗Referência
CVE-2026-84431
AirAsia MOVE App com.airasia.mobile com.airasia.core.utils.RealPathUtil.getRealPath path traversal
33RISK
open ↗Referência
CVE-2026-84696
Phison PS3111-S11 Controller Firmware Missing Authentication on Vendor Unique Commands
48RISK
open ↗Referência
CVE-2026-84287
NousResearch hermes-agent Session Chat api_server.py denial of service
33RISK
open ↗Referência
Anuko Time Tracker 1.19.23.5325 - CSV/Formula Injection
CSV injection in Anuko Time Tracker
41RISK
open ↗Referência
CVE-2005-2428
Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hid
60RISK
open ↗Referência
CVE-2026-8207
Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/gr
41RISK
open ↗Referência
CVE-2026-103543
itsourcecode Leave Management System controller.php sql injection
33RISK
open ↗Referência
CVE-2021-47928
Opencart TMD Vendor System 3.x Blind SQL Injection via product route
41RISK
open ↗Referência
CVE-2011-5204
Akiva WebBoard 8.x stores passwords in plaintext, which allows local users to obtain sensitive information by reading fr
23RISK
open ↗Referência
CVE-2017-14839
TeamWork Photo Fusion allows Arbitrary File Upload in changeAvatar and changeCover.
23RISK
open ↗Referência
CVE-2018-15844
An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's pas
23RISK
open ↗Referência
CVE-2018-18797
School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.
23RISK
open ↗Referência
CVE-2014-8687
Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root
50RISK
open ↗Referência
CVE-2026-19709
Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass
33RISK
open ↗Referência
CVE-2011-5283
Cross-site scripting (XSS) vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Expre
23RISK
open ↗Referência
CVE-2026-75087
itsourcecode Hospital Management System viewdepartment.php sql injection
33RISK
open ↗Referência
CVE-2011-5283
Cross-site scripting (XSS) vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Expre
23RISK
open ↗Referência
CVE-2026-75876
xianrendzw EasyReport Move Operations ModuleController.java sql injection
33RISK
open ↗Referência
CVE-2018-18798
Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.ph
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.