Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-93959
CVE-2026-93959MEDIUM
SourceCodester Online Reviewer Management System btn_functions.php sql injection
33RISK
open ↗
Referência
CVE-2026-14844
CVE-2026-14844MEDIUM
Master Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes
33RISK
open ↗
Referência
CVE-2026-92425
CVE-2026-92425MEDIUM
Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR
33RISK
open ↗
Referência✓ VexDay Proof
SanyBee Gallery 0.1.1 - 'p' Local File Inclusion
CVE-2007-6648—webappsphp
Directory traversal vulnerability in index.php in SanyBee Gallery 0.1.0 and 0.1.1 allows remote attackers to include and
23RISK
open ↗
Referência✓ VexDay Proof
XRms 1.99.2 - Remote File Inclusion / Cross-Site Scripting / Information Gathering
CVE-2008-3398—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in XRMS CRM 1.99.2 allow remote attackers to inject arbitrary web sc
23RISK
open ↗
Referência
CVE-2012-3810
CVE-2012-3810—
Samsung Kies before 2.5.0.12094_27_11 has registry modification.
23RISK
open ↗
Referência
CVE-2013-2619
CVE-2013-2619—
Directory traversal vulnerability in Aspen before 0.22 allows remote attackers to read arbitrary files via a .. (dot dot
23RISK
open ↗
Referência
CVE-2018-9237
CVE-2018-9237—
iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.
23RISK
open ↗
Referência
CVE-2018-9238
CVE-2018-9238—
proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter.
23RISK
open ↗
Referência
CVE-2026-85350
CVE-2026-85350MEDIUM
UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together
33RISK
open ↗
Referência
CVE-2026-16051
CVE-2026-16051CRITICAL
WPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install Action
48RISK
open ↗
Referência✓ VexDay Proof
Dayfox Blog 4 - Multiple Local File Inclusions
CVE-2008-3564—webappsphp
Multiple directory traversal vulnerabilities in index.php in Dayfox Blog 4 allow remote attackers to include and execute
23RISK
open ↗
Referência
CVE-2023-54399
CVE-2023-54399CRITICAL
Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettree
48RISK
open ↗
Referência
CVE-2026-16557
CVE-2026-16557MEDIUM
Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins
33RISK
open ↗
Referência
CVE-2023-54399
CVE-2023-54399CRITICAL
Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettree
48RISK
open ↗
Referência
CVE-2026-85703
CVE-2026-85703MEDIUM
ramon-victor freegpt-webui Jailbreak Mode backend.py getJailbreak allocation of resources
33RISK
open ↗
Referência
Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE
CVE-2025-1097HIGHremotemultiple
ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation
68RISK
open ↗
Referência
CVE-2026-18037
CVE-2026-18037MEDIUM
Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication
33RISK
open ↗
Referência
CVE-2026-16293
CVE-2026-16293MEDIUM
Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL
33RISK
open ↗
Referência
CVE-2026-16589
CVE-2026-16589HIGH
WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter
41RISK
open ↗
Referência
CVE-2026-85702
CVE-2026-85702MEDIUM
ramon-victor freegpt-webui Backend Conversation API backend.py _conversation missing authentication
33RISK
open ↗
Referência
CVE-2026-80116
CVE-2026-80116HIGH
PassMark PerformanceTest, BurnInTest, and OSForensics Privilege Escalation via DirectIo64.sys IOCTL
41RISK
open ↗
Referência✓ VexDay Proof
Mihalism Multi Forum Host 3.0.x - Remote File Inclusion
CVE-2007-6657—webappsphp
PHP remote file inclusion vulnerability in source/includes/load_forum.php in Mihalism Multi Forum Host 3.0.x and earlier
23RISK
open ↗
Referência
CVE-2026-85637
CVE-2026-85637MEDIUM
jofpin trape Admin Endpoint sockets.py join_room missing authentication
33RISK
open ↗
Referência✓ VexDay Proof
VideoLAN VLC Media Player 0.8.6i - '.tta' File Parsing Heap Overflow (PoC)
CVE-2008-3732—dosmultiple
Integer overflow in the Open function in modules/demux/tta.c in VLC Media Player 0.8.6i allows remote attackers to cause
28RISK
open ↗
Referência
CVE-2026-8256
CVE-2026-8256MEDIUM
Devs Palace ERP Online mr-save cross site scripting
33RISK
open ↗
Referência✓ VexDay Proof
Active PHP BookMarks 1.1.02 - SQL Injection
CVE-2008-3748—webappsphp
SQL injection vulnerability in view_group.php in Active PHP Bookmarks (APB) 1.1.02 and 1.2.06 allows remote attackers to
23RISK
open ↗
Referência
CVE-2011-1099
CVE-2011-1099—
Multiple directory traversal vulnerabilities in FocalMedia.Net Quick Polls before 1.0.2 allow remote attackers to (1) re
23RISK
open ↗
Referência
CVE-2026-8255
CVE-2026-8255MEDIUM
Devs Palace ERP Online add_new_customer cross site scripting
33RISK
open ↗
Referência
CVE-2026-8251
CVE-2026-8251MEDIUM
Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of service
33RISK
open ↗
← previouspage 520 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.