Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-5007
kazuph mcp-docs-rag add_git_repository/add_text_file index.ts cloneRepository os command injection
33RISK
open ↗Referência
CVE-2026-5004
Wavlink WL-WN579X3-C UPNP firewall.cgi sub_4019FC stack-based overflow
41RISK
open ↗Referência
CVE-2026-5003
PromtEngineer localGPT Web api_server.py handle_index information disclosure
33RISK
open ↗Referência
CVE-2026-5002
PromtEngineer localGPT LLM Prompt server.py _route_using_overviews injection
33RISK
open ↗Referência
CVE-2026-4998
Sinaptik AI PandasAI Chat Message code_executor.py CodeExecutor.execute code injection
33RISK
open ↗Referência
CVE-2026-4997
Sinaptik AI PandasAI sql_sanitizer.py is_sql_query_safe path traversal
33RISK
open ↗Referência
CVE-2018-25221
EChat Server 3.1 Buffer Overflow via chat.ghp username Parameter
48RISK
open ↗Referência✓ VexDay Proof
Crazy Goomba 1.2.1 - 'id' SQL Injection
SQL injection vulnerability in commentaires.php in Crazy Goomba 1.2.1 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência
CVE-2015-3245
Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in t
38RISK
open ↗Referência
CVE-2014-10013
SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to
23RISK
open ↗Referência
CVE-2012-5875
Firefly Media Server 1.0.0.1359 allows remote attackers to cause a denial of service (NULL pointer dereference) via a (1
28RISK
open ↗Referência
CVE-2018-2636
Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Security).
28RISK
open ↗Referência✓ VexDay Proof
MiniBB 2.2 - Cross-Site Scripting / SQL Injection / Full Path Disclosure
Multiple SQL injection vulnerabilities in (1) setup_mysql.php and (2) setup_options.php in miniBB 2.2 and possibly earli
23RISK
open ↗Referência
CVE-2018-6398
SQL Injection exists in the CP Event Calendar 3.0.1 component for Joomla! via the id parameter in a task=load action.
23RISK
open ↗Referência
CVE-2012-1208
Multiple cross-site scripting (XSS) vulnerabilities in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other
23RISK
open ↗Referência
CVE-2018-6481
A buffer overflow vulnerability in the control protocol of Disk Savvy Enterprise v10.4.18 allows remote attackers to exe
28RISK
open ↗Referência
CVE-2017-0124
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.