Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-78247
SourceCodester Simple Online Food Ordering System ajax.php confirm_order sql injection
33RISK
open ↗Referência
CVE-2026-78245
itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload
33RISK
open ↗Referência
CVE-2026-78244
itsourcecode Real Estate Management System search.php sql injection
33RISK
open ↗Referência
CVE-2015-2524
Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not proper
23RISK
open ↗Referência
CVE-2026-19053
ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter
48RISK
open ↗Referência
CVE-2016-0492
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12
60RISK
open ↗Referência
CVE-2017-15975
Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability
23RISK
open ↗Referência
CVE-2017-17601
Cab Booking Script 1.0 has SQL Injection via the /service-list city parameter.
23RISK
open ↗Referência
CVE-2006-1652
Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-ass
50RISK
open ↗Referência
CVE-2006-1652
Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-ass
50RISK
open ↗Referência✓ VexDay Proof
phpunity.postcard - 'gallery_path' Remote File Inclusion
PHP remote file inclusion vulnerability in phpunity-postcard.php in phpunity.postcard allows remote attackers to execute
23RISK
open ↗Referência
CVE-2017-17604
Entrepreneur Bus Booking Script 3.0.4 has SQL Injection via the booker_details.php sourcebus parameter.
23RISK
open ↗Referência
CVE-2026-108633
JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/add
33RISK
open ↗Referência
CVE-2017-17613
Freelance Website Script 2.0.6 has SQL Injection via the jobdetails.php pr_id parameter or the searchbycat_list.php cati
23RISK
open ↗Referência
CVE-2026-108624
JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint
33RISK
open ↗Referência
CVE-2014-2023
Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allo
23RISK
open ↗Referência
CVE-2006-7127
Multiple PHP remote file inclusion vulnerabilities in JAF CMS 4.0 and 4.0 RC2 allow remote attackers to execute arbitrar
23RISK
open ↗Referência
CVE-2015-3864
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
60RISK
open ↗Referência
CVE-2026-8263
Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection
33RISK
open ↗Referência
CVE-2026-8250
Open5GS SMF n4-build.c smf_n4_build_qos_flow_to_modify_list denial of service
33RISK
open ↗Referência
CVE-2026-8249
Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of service
33RISK
open ↗Referência
CVE-2021-47930
Balbooa Joomla Forms Builder 2.0.6 SQL Injection Unauthenticated
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.