Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2006-1652
Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-ass
50RISK
open ↗Referência
CVE-2006-1652
Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-ass
50RISK
open ↗Referência✓ VexDay Proof
phpunity.postcard - 'gallery_path' Remote File Inclusion
PHP remote file inclusion vulnerability in phpunity-postcard.php in phpunity.postcard allows remote attackers to execute
23RISK
open ↗Referência
CVE-2017-17604
Entrepreneur Bus Booking Script 3.0.4 has SQL Injection via the booker_details.php sourcebus parameter.
23RISK
open ↗Referência
CVE-2026-108633
JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/add
33RISK
open ↗Referência
CVE-2017-17613
Freelance Website Script 2.0.6 has SQL Injection via the jobdetails.php pr_id parameter or the searchbycat_list.php cati
23RISK
open ↗Referência
CVE-2026-108624
JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint
33RISK
open ↗Referência
CVE-2014-2023
Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allo
23RISK
open ↗Referência
CVE-2022-50959
WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php
33RISK
open ↗Referência
CVE-2022-50958
WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.php
33RISK
open ↗Referência
CVE-2022-50947
WordPress Plugin Testimonial Slider and Showcase 2.2.6 Stored XSS
33RISK
open ↗Referência
CVE-2015-7246
D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root accou
28RISK
open ↗Referência
CVE-2013-5758
cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by
28RISK
open ↗Referência
CVE-2017-17628
Responsive Realestate Script 3.2 has SQL Injection via the property-list tbud parameter.
23RISK
open ↗Referência
CVE-2026-8244
Industrial Application Software IAS Canias ERP Login RMI improper authentication
33RISK
open ↗Referência
CVE-2026-8242
Industrial Application Software IAS Canias ERP Login RMI doAction response discrepancy
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.