Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path
CVE-2022-35899—localwindows
There is an unquoted service path in ASUSTeK Aura Ready Game SDK service (GameSDK.exe) 1.0.0.4. This might allow a local
23RISK
open ↗
Referência
CVE-2026-115281
CVE-2026-115281MEDIUM
Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute
33RISK
open ↗
Referência
CVE-2026-115224
CVE-2026-115224MEDIUM
Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding
33RISK
open ↗
Referência
CVE-2026-113813
CVE-2026-113813MEDIUM
PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure
33RISK
open ↗
Referência
CVE-2026-115282
CVE-2026-115282MEDIUM
Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure
33RISK
open ↗
Referência
CVE-2026-118578
CVE-2026-118578MEDIUM
maotoumao MusicFreeDesktop Request Forwarder information disclosure
33RISK
open ↗
Referência
CVE-2026-118577
CVE-2026-118577MEDIUM
maotoumao MusicFreeDesktop Request Forwarder server-side request forgery
33RISK
open ↗
Referência
CVE-2026-113494
CVE-2026-113494LOW
GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode
28RISK
open ↗
Referência
aiohttp 3.9.1 - directory traversal PoC
CVE-2024-23334MEDIUMwebappspython
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
70RISK
open ↗
Referência
CVE-2026-103372
CVE-2026-103372MEDIUM
Payconiq for WooCommerce <= 1.0.4 - Unauthenticated Order Key Disclosure
33RISK
open ↗
Referência
CVE-2026-117514
CVE-2026-117514MEDIUM
oretnom23 php-travel-agency-system Admin Record Pages customer_detail.php sql injection
33RISK
open ↗
Referência
CVE-2026-82808
CVE-2026-82808MEDIUM
Inbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentials
33RISK
open ↗
Referência
CVE-2026-7487
CVE-2026-7487LOW
Access Control Check Implemented After Asset is Accessed in GitLab
28RISK
open ↗
Referência
CVE-2017-6542
CVE-2017-6542—
The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large
28RISK
open ↗
Referência
CVE-2026-103331
CVE-2026-103331MEDIUM
UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Order Payment Forgery via Empty IPN Secret
33RISK
open ↗
Referência
CVE-2026-118275
CVE-2026-118275MEDIUM
a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption
33RISK
open ↗
Referência
CVE-2014-125136
CVE-2014-125136HIGH
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup
41RISK
open ↗
Referência
CVE-2026-1168
CVE-2026-1168HIGH
Allocation of Resources Without Limits or Throttling in GitLab
41RISK
open ↗
Referência
CVE-2017-8646
CVE-2017-8646—
Microsoft Edge in Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in t
35RISK
open ↗
Referência
CVE-2024-8945
CVE-2024-8945MEDIUM
CodeCanyon RISE Ultimate Project Manager save sql injection
38RISK
open ↗
Referência
CVE-2026-92458
CVE-2026-92458MEDIUM
yshop-crm through 2.1.3 Missing Authorization via StoreProductController onSale
33RISK
open ↗
Referência
CVE-2026-76640
CVE-2026-76640HIGH
Unitree G1 EDU 1.5.2 BLE GATT RCE via WiFi Provisioning Stack
41RISK
open ↗
Referência
CVE-2026-92457
CVE-2026-92457HIGH
yshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoice
41RISK
open ↗
Referência
CVE-2026-75417
CVE-2026-75417HIGH
A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid() function within applicat
41RISK
open ↗
Referência
CVE-2026-77693
CVE-2026-77693HIGH
Order Tip for WooCommerce < 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete_exported_csv_file_ajax
41RISK
open ↗
Referência✓ VexDay Proof
Eskolar CMS 0.9.0.0 - Blind SQL Injection
CVE-2006-3727—webappsphp
Multiple SQL injection vulnerabilities in Eskolar CMS 0.9.0.0 allow remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
CVE-2026-75798
CVE-2026-75798MEDIUM
AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant
33RISK
open ↗
Referência
CVE-2026-16984
CVE-2026-16984MEDIUM
WP Legal Pages < 3.7.1 - Unauthenticated API Secret Disclosure
33RISK
open ↗
Referência
CVE-2015-6098
CVE-2015-6098—
Buffer overflow in the Network Driver Interface Standard (NDIS) implementation in Microsoft Windows Vista SP2, Windows S
23RISK
open ↗
Referência
CVE-2026-92456
CVE-2026-92456HIGH
yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints
41RISK
open ↗
← previouspage 524 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.