Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-5679
CVE-2026-5679MEDIUM
Totolink A3300R cstecgi.cgi vsetTr069Cfg os command injection
33RISK
open ↗
Referência
CVE-2026-5678
CVE-2026-5678MEDIUM
Totolink A7100RU cstecgi.cgi setScheduleCfg os command injection
33RISK
open ↗
Referência
CVE-2026-5677
CVE-2026-5677MEDIUM
Totolink A7100RU cstecgi.cgi CsteSystem os command injection
33RISK
open ↗
Referência
CVE-2026-5676
CVE-2026-5676MEDIUM
Totolink A8000R cstecgi.cgi setLanguageCfg missing authentication
33RISK
open ↗
Referência
CVE-2026-5675
CVE-2026-5675MEDIUM
itsourcecode Construction Management System Parameter borrowed_tool.php sql injection
33RISK
open ↗
Referência
CVE-2026-5672
CVE-2026-5672MEDIUM
code-projects Simple IT Discussion Forum Parameter edit-category.php sql injection
33RISK
open ↗
Referência
CVE-2014-6287
CVE-2014-6287CRITICALunder attack
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗
Referência✓ VexDay Proof
Exponent CMS 0.96.3 - 'view' Remote Command Execution
CVE-2006-4963—webappsphp
Directory traversal vulnerability in index.php in Exponent CMS 0.96.3 allows remote attackers to read and execute arbitr
23RISK
open ↗
Referência
CVE-2026-74992
CVE-2026-74992MEDIUM
Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload
33RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke Module books SQL - 'cid' SQL Injection
CVE-2008-0827—webappsphp
SQL injection vulnerability in the Books module of PHP-Nuke allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência
CVE-2012-3577
CVE-2012-3577—
Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress
28RISK
open ↗
Referência
CVE-2026-58055
CVE-2026-58055MEDIUM
nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length
33RISK
open ↗
Referência
CVE-2026-19993
CVE-2026-19993MEDIUM
Webkul Bagisto RMA State Validation update-status behavioral workflow
33RISK
open ↗
Referência
CVE-2026-94094
CVE-2026-94094MEDIUM
OpenClaw Canvas Host Route server.ts createCanvasHostHandler denial of service
33RISK
open ↗
Referência
CVE-2026-76582
CVE-2026-76582MEDIUM
TRENDnet TEW-821DAP ssi ping.cgi system command injection
33RISK
open ↗
Referência✓ VexDay Proof
Gregarius 0.5.4 - SQL Injection
CVE-2008-3374—webappsphp
SQL injection vulnerability in ajax.php in Gregarius 0.5.4 and earlier allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2014-6332
CVE-2014-6332HIGHunder attack
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISK
open ↗
Referência
CVE-2026-19782
CVE-2026-19782MEDIUM
WPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users
33RISK
open ↗
Referência
CVE-2026-15049
CVE-2026-15049HIGH
Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import
41RISK
open ↗
Referência
CVE-2013-2572
CVE-2013-2572—
A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 d
28RISK
open ↗
Referência
CVE-2026-19812
CVE-2026-19812HIGH
TOTOLINK A800R product.so cstecgi.cgi UploadCustomModule stack-based overflow
41RISK
open ↗
Referência
CVE-2013-2572
CVE-2013-2572—
A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 d
28RISK
open ↗
Referência
CVE-2013-2573
CVE-2013-2573—
A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Cam
35RISK
open ↗
Referência
CVE-2018-9237
CVE-2018-9237—
iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.
23RISK
open ↗
Referência
CVE-2018-9238
CVE-2018-9238—
proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter.
23RISK
open ↗
Referência
CVE-2026-85350
CVE-2026-85350MEDIUM
UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together
33RISK
open ↗
Referência
CVE-2026-16051
CVE-2026-16051CRITICAL
WPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install Action
48RISK
open ↗
Referência✓ VexDay Proof
Dayfox Blog 4 - Multiple Local File Inclusions
CVE-2008-3564—webappsphp
Multiple directory traversal vulnerabilities in index.php in Dayfox Blog 4 allow remote attackers to include and execute
23RISK
open ↗
Referência
CVE-2023-54399
CVE-2023-54399CRITICAL
Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettree
48RISK
open ↗
Referência
CVE-2026-16557
CVE-2026-16557MEDIUM
Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins
33RISK
open ↗
← previouspage 543 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.