Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2017-15971
CVE-2017-15971—
Same Sex Dating Software Pro 1.0 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php send
23RISK
open ↗
Referência
CVE-2021-40379
CVE-2021-40379—
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. rstp://.../medias2 doe
28RISK
open ↗
Referência
CVE-2017-17576
CVE-2017-17576—
FS Gigs Script 1.0 has SQL Injection via the browse-category.php cat parameter, browse-scategory.php sc parameter, or se
23RISK
open ↗
Referência
CVE-2017-17578
CVE-2017-17578—
FS Crowdfunding Script 1.0 has SQL Injection via the latest_news_details.php id parameter.
23RISK
open ↗
Referência
CVE-2026-78051
CVE-2026-78051MEDIUM
alexta69 MeTube Cookie File cookies.txt file access
33RISK
open ↗
Referência
CVE-2026-18356
CVE-2026-18356LOW
Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email
28RISK
open ↗
Referência
CVE-2026-78057
CVE-2026-78057MEDIUM
sambitraj Student-Management-System Management Mutation sql injection
33RISK
open ↗
Referência
CVE-2026-17559
CVE-2026-17559MEDIUM
Content Protector (Passster) < 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass
33RISK
open ↗
Referência✓ VexDay Proof
File Store PRO 3.2 - Multiple Blind SQL Injections
CVE-2006-1278—webappsphp
SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência
CVE-2026-78050
CVE-2026-78050CRITICAL
Comfast CF-N1-S Web Management mbox-config sub_41AD7C stack-based overflow
48RISK
open ↗
Referência✓ VexDay Proof
PHP iCalendar 2.21 - 'publish.ical.php' Remote Code Execution
CVE-2006-1291—webappsphp
publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write acce
23RISK
open ↗
Referência
CVE-2026-77002
CVE-2026-77002CRITICAL
SmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentication Bypass
48RISK
open ↗
Referência
CVE-2026-77001
CVE-2026-77001CRITICAL
Social Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication Bypass
48RISK
open ↗
Referência
CVE-2026-13176
CVE-2026-13176LOW
Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery
28RISK
open ↗
Referência
CVE-2026-77686
CVE-2026-77686MEDIUM
Dolibarr Account card.php improper authorization
33RISK
open ↗
Referência
CVE-2026-77681
CVE-2026-77681MEDIUM
CodeAstro Online Job Portal update-profile.php unrestricted upload
33RISK
open ↗
Referência
CVE-2016-10033
CVE-2016-10033CRITICALunder attack
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RISK
open ↗
Referência
CVE-2026-70667
CVE-2026-70667MEDIUM
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)
33RISK
open ↗
Referência
CVE-2026-16595
CVE-2026-16595MEDIUM
WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure
33RISK
open ↗
Referência
CVE-2026-15215
CVE-2026-15215HIGH
Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation
41RISK
open ↗
Referência
CVE-2017-17605
CVE-2017-17605—
Consumer Complaints Clone Script 1.0 has SQL Injection via the other-user-profile.php id parameter.
23RISK
open ↗
Referência
CVE-2017-17609
CVE-2017-17609—
Chartered Accountant Booking Script 1.0 has SQL Injection via the /service-list city parameter.
23RISK
open ↗
Referência
CVE-2020-14882
CVE-2020-14882CRITICALunder attack
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
open ↗
Referência
CVE-2026-19049
CVE-2026-19049HIGH
ProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removesite' Cookie
41RISK
open ↗
Referência
CVE-2020-14882
CVE-2020-14882CRITICALunder attack
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
open ↗
Referência✓ VexDay Proof
Light Weight Calendar 1.x - 'date' Remote Code Execution
CVE-2006-1252—webappsphp
Eval injection vulnerability in cal.php in Light Weight Calendar (LWC) 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2026-15214
CVE-2026-15214MEDIUM
Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOR
33RISK
open ↗
Referência
CVE-2026-15032
CVE-2026-15032MEDIUM
wpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion
33RISK
open ↗
Referência
CVE-2022-50964
CVE-2022-50964MEDIUM
uBidAuction 2.0.1 myAuctions loose Reflected XSS
33RISK
open ↗
Referência
CVE-2022-50964
CVE-2022-50964MEDIUM
uBidAuction 2.0.1 myAuctions loose Reflected XSS
33RISK
open ↗
← previouspage 528 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.