Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-14817
CVE-2026-14817MEDIUM
Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes
33RISK
open ↗
Referência✓ VexDay Proof
PHP Blue Dragon CMS 2.9 - Remote File Inclusion
CVE-2006-2392—webappsphp
PHP remote file inclusion vulnerability in public_includes/pub_popup/popup_finduser.php in PHP Blue Dragon Platinum 2.8.
23RISK
open ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RISK
open ↗
Referência✓ VexDay Proof
PEGames - 'index.php' Remote File Inclusion
CVE-2006-6213—webappsphp
index.php in PEGames uses the extract function to overwrite critical variables, which allows remote attackers to conduct
23RISK
open ↗
Referência
CVE-2017-17630
CVE-2017-17630—
Yoga Class Script 1.0 has SQL Injection via the /list city parameter.
23RISK
open ↗
Referência
CVE-2017-17632
CVE-2017-17632—
Responsive Events And Movie Ticket Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.
23RISK
open ↗
Referência
CVE-2017-17632
CVE-2017-17632—
Responsive Events And Movie Ticket Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.
23RISK
open ↗
Referência
CVE-2026-15480
CVE-2026-15480HIGH
Trendnet TEW-635BRM Web Service rc start_httpd stack-based overflow
41RISK
open ↗
Referência✓ VexDay Proof
torrentflux 2.2 - Arbitrary File Create/ Execute/Delete
CVE-2006-6328—webappsphp
Directory traversal vulnerability in index.php for TorrentFlux 2.2 allows remote attackers to create or overwrite arbitr
23RISK
open ↗
Referência
CVE-2019-3010
CVE-2019-3010HIGHunder attack
Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is a
91RISK
open ↗
Referência
CVE-2017-17633
CVE-2017-17633—
Multiplex Movie Theater Booking Script 3.1.5 has SQL Injection via the trailer-detail.php moid parameter, show-time.php
23RISK
open ↗
Referência
CVE-2026-2441
CVE-2026-2441HIGHunder attack
Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside
83RISK
open ↗
Referência
CVE-2017-17634
CVE-2017-17634—
Single Theater Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.
23RISK
open ↗
Referência
CVE-2017-17637
CVE-2017-17637—
Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.
23RISK
open ↗
Referência
CVE-2018-4404
CVE-2018-4404HIGH
In iOS before 11.4 and macOS High Sierra before 10.13.5, a memory corruption issue exists and was addressed with improve
61RISK
open ↗
Referência
CVE-2017-7938
CVE-2017-7938MEDIUM
Stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) version 1.3a (Unix) allows attackers to cau
33RISK
open ↗
Referência
CVE-2019-5418
CVE-2019-5418HIGHunder attack
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where spe
100RISK
open ↗
Referência
CVE-2026-105314
CVE-2026-105314HIGH
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call
41RISK
open ↗
Referência
CVE-2026-116111
CVE-2026-116111MEDIUM
2K Games Civilization V Lua Sandbox loadstring type confusion
33RISK
open ↗
Referência
CVE-2026-11495
CVE-2026-11495MEDIUM
CodeAstro Ingredients Stock Management System add_stock.php sql injection
33RISK
open ↗
Referência
CVE-2026-11494
CVE-2026-11494MEDIUM
TOTOLINK AC1200 T8 vsftpd vsftpd.conf least privilege violation
33RISK
open ↗
Referência✓ VexDay Proof
phpBB2 Plus 1.53 - Acronym Mod SQL Injection
CVE-2006-6842—webappsphp
SQL injection vulnerability in admin/admin_acronyms.php in the Acronym Mod 0.9.5 for phpBB2 Plus 1.53 allows remote atta
23RISK
open ↗
Referência
CVE-2026-116110
CVE-2026-116110MEDIUM
GiantappMan LiveWallPaper SignalR Hub UploadFile missing authentication
33RISK
open ↗
Referência
CVE-2026-105247
CVE-2026-105247MEDIUM
SourceCodester Online Reviewer Management System btn_functions.php course sql injection
33RISK
open ↗
Referência✓ VexDay Proof
wywo inout board 1.0 - Multiple Vulnerabilities
CVE-2006-6846—webappsasp
Multiple SQL injection vulnerabilities in While You Were Out (WYWO) InOut Board 1.0 allow remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2017-2373
CVE-2017-2373—
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS
23RISK
open ↗
Referência
CVE-2017-2442
CVE-2017-2442—
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issu
23RISK
open ↗
Referência
CVE-2026-100881
CVE-2026-100881LOW
zhistaredu StarTraining application.yml cross site scripting
28RISK
open ↗
Referência
CVE-2026-114741
CVE-2026-114741LOW
WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR
28RISK
open ↗
Referência
MarcomCentral FusionPro VDP Creator < 10.0 - Directory Traversal
CVE-2019-7751—webappswindows
A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral, for
28RISK
open ↗
← previouspage 547 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.