Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2009-4925
CVE-2009-4925—
Multiple SQL injection vulnerabilities in Portale e-commerce Creasito (aka creasito e-commerce content manager) 1.3.16,
23RISK
open ↗
Referência
CVE-2011-5173
CVE-2011-5173—
Buffer overflow in Bugbear Entertainment FlatOut 2005 allows user-assisted remote attackers to cause a denial of service
23RISK
open ↗
Referência
CVE-2013-5758
CVE-2013-5758—
cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by
28RISK
open ↗
Referência
CVE-2016-3943
CVE-2016-3943—
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a
23RISK
open ↗
Referência
CVE-2026-8215
CVE-2026-8215MEDIUM
Industrial Application Software IAS Canias ERP RMI iasRequestFileEvent path traversal
33RISK
open ↗
Referência
CVE-2010-3602
CVE-2010-3602—
Cross-site scripting (XSS) vulnerability in ProfileView.aspx in mojoPortal 2.3.4.3 and 2.3.5.1 allows remote attackers t
23RISK
open ↗
Referência
CVE-2021-28420
CVE-2021-28420—
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and th
23RISK
open ↗
Referência
CVE-2021-28935
CVE-2021-28935—
CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > M
23RISK
open ↗
Referência
CVE-2021-29447
CVE-2021-29447HIGH
WordPress Authenticated XXE attack when installation is running PHP 8
63RISK
open ↗
Referência
CVE-2009-3812
CVE-2009-3812—
Heap-based buffer overflow in OtsAV DJ trial version 1.85.64.0, Radio trial version 1.85.64.0, TV trial version 1.85.64.
23RISK
open ↗
Referência
CVE-2026-8210
CVE-2026-8210MEDIUM
aandrew-me tgpt Update helper.go helper.Update command injection
33RISK
open ↗
Referência
CVE-2011-5211
CVE-2011-5211—
Cross-site scripting (XSS) vulnerability in the poll module in Subrion CMS 2.0.4 allows remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2026-8196
CVE-2026-8196MEDIUM
JeecgBoot mLogin Endpoint LoginController.java authorization
33RISK
open ↗
Referência
CVE-2016-4137
CVE-2016-4137—
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsof
28RISK
open ↗
Referência✓ VexDay Proof
JaxUltraBB 2.0 - 'delete.php' Remote Auto Deface
CVE-2006-5511—webappsphp
Direct static code injection vulnerability in delete.php in JaxUltraBB (JUBB) 2.0, when register_globals is enabled, all
23RISK
open ↗
Referência
CVE-2016-4207
CVE-2016-4207—
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acro
28RISK
open ↗
Referência✓ VexDay Proof
SuperNET Shop 1.0 - SQL Injection
CVE-2008-6204—webappsasp
Multiple SQL injection vulnerabilities in SuperNET Shop 1.0 and earlier allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2010-3603
CVE-2010-3603—
Cross-site request forgery (CSRF) vulnerability in the file manager service (Services/FileService.ashx) in mojoPortal 2.
23RISK
open ↗
Referência
CVE-2010-3608
CVE-2010-3608—
Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the (1
23RISK
open ↗
Referência
CVE-2026-7226
CVE-2026-7226MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php login2 sql injection
33RISK
open ↗
Referência
CVE-2026-7225
CVE-2026-7225MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php delete_menu sql injection
33RISK
open ↗
Referência
CVE-2026-7224
CVE-2026-7224MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php delete_cart sql injection
33RISK
open ↗
Referência
CVE-2026-7223
CVE-2026-7223MEDIUM
BigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgery
33RISK
open ↗
Referência
CVE-2016-4231
CVE-2016-4231—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RISK
open ↗
Referência
CVE-2026-86228
CVE-2026-86228MEDIUM
JeecgBoot AiragModelController.java exportXls access control
33RISK
open ↗
Referência
CVE-2026-15250
CVE-2026-15250MEDIUM
LatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel
33RISK
open ↗
Referência
CVE-2026-86227
CVE-2026-86227LOW
valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds
28RISK
open ↗
Referência
CVE-2018-1000001
CVE-2018-1000001—
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before th
43RISK
open ↗
Referência
CVE-2026-86225
CVE-2026-86225MEDIUM
SourceCodester Class and Exam Timetabling System modal_add_room.php mysqli_query sql injection
33RISK
open ↗
Referência
CVE-2026-86224
CVE-2026-86224MEDIUM
SourceCodester Class and Exam Timetabling System modal_add_product.php mysqli_query sql injection
33RISK
open ↗
← previouspage 512 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.