Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits

40,553CVEs with public exploitation

24,696lab-tested

All Referência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecent popular risk

26,327 exploits

Referência

CVE-2026-78244

CVE-2026-78244MEDIUM

itsourcecode Real Estate Management System search.php sql injection

33RISK

open ↗

Referência

CVE-2015-2524

CVE-2015-2524—

Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not proper

23RISK

open ↗

Referência

CVE-2026-19053

CVE-2026-19053CRITICAL

ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter

48RISK

open ↗

Referência

CVE-2016-0492

CVE-2016-0492—

Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12

60RISK

open ↗

Referência

CVE-2017-15975

CVE-2017-15975—

Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability

23RISK

open ↗

Referência

CVE-2017-17601

CVE-2017-17601—

Cab Booking Script 1.0 has SQL Injection via the /service-list city parameter.

23RISK

open ↗

Referência

CVE-2026-3220

CVE-2026-3220HIGH

Multiple Plugins - Unauthenticated Stored XSS via Minify Library

41RISK

open ↗

Referência

CVE-2006-1652

CVE-2006-1652—

Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-ass

50RISK

open ↗

Referência

CVE-2006-1652

CVE-2006-1652—

Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-ass

50RISK

open ↗

Referência✓ VexDay Proof

phpunity.postcard - 'gallery_path' Remote File Inclusion

CVE-2006-4869—webappsphp

PHP remote file inclusion vulnerability in phpunity-postcard.php in phpunity.postcard allows remote attackers to execute

23RISK

open ↗

Referência

CVE-2017-17604

CVE-2017-17604—

Entrepreneur Bus Booking Script 3.0.4 has SQL Injection via the booker_details.php sourcebus parameter.

23RISK

open ↗

Referência

CVE-2026-108633

CVE-2026-108633MEDIUM

JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/add

33RISK

open ↗

Referência

CVE-2017-17613

CVE-2017-17613—

Freelance Website Script 2.0.6 has SQL Injection via the jobdetails.php pr_id parameter or the searchbycat_list.php cati

23RISK

open ↗

Referência

CVE-2026-108624

CVE-2026-108624MEDIUM

JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint

33RISK

open ↗

Referência

CVE-2014-2023

CVE-2014-2023—

Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allo

23RISK

open ↗

Referência

CVE-2017-17622

CVE-2017-17622—

Online Exam Test Application Script 1.6 has SQL Injection via the exams.php sort parameter.

23RISK

open ↗

Referência

CVE-2017-17625

CVE-2017-17625—

Professional Service Script 1.0 has SQL Injection via the service-list city parameter.

23RISK

open ↗

Referência

CVE-2013-5316

CVE-2013-5316—

Cross-site request forgery (CSRF) vulnerability in RiteCMS 1.0.0 allows remote attackers to hijack the authentication of

23RISK

open ↗

Referência

CVE-2015-5116

CVE-2015-5116—

Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481

28RISK

open ↗

Referência

CVE-2015-5065

CVE-2015-5065—

Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic

28RISK

open ↗

Referência

CVE-2020-15922

CVE-2020-15922—

There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE)

35RISK

open ↗

Referência

Opmon 9.11 - Cross-site Scripting

CVE-2021-43009—remotemultiple

A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the reque

23RISK

open ↗

Referência

CVE-2021-43936

CVE-2021-43936CRITICAL

Distributed Data Systems WebHM

60RISK

open ↗

Referência

CVE-2026-16016

CVE-2026-16016MEDIUM

poco-ai poco-claw task.py run_task server-side request forgery

33RISK

open ↗

Referência✓ VexDay Proof

Web-News 1.6.3 - 'template.php' Remote File Inclusion

CVE-2006-5053—webappsphp

PHP remote file inclusion vulnerability in webnews/template.php in Web-News 1.6.3 and earlier allows remote attackers to

23RISK

open ↗

Referência

CVE-2026-75783

CVE-2026-75783CRITICAL

TRENDnet TEW-WLC100P DHCP blobmsg netifd stack-based overflow

48RISK

open ↗

Referência

CVE-2013-6221

CVE-2013-6221—

Directory traversal vulnerability in CommunicationServlet in HP Service Virtualization 3.x before 3.50.1, when the AutoP

60RISK

open ↗

Referência

CVE-2014-5144

CVE-2014-5144—

Cross-site scripting (XSS) vulnerability in Telescope before 0.9.3 allows remote authenticated users to inject arbitrary

23RISK

open ↗

Referência

CVE-2015-7601

CVE-2015-7601—

Directory traversal vulnerability in PCMan's FTP Server 2.0.7 allows remote attackers to read arbitrary files via a ..//

50RISK

open ↗

Referência

CVE-2017-17634

CVE-2017-17634—

Single Theater Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.