Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-108963
CVE-2026-108963HIGH
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a data
41RISK
open ↗
Referência
CVE-2026-108768
CVE-2026-108768MEDIUM
zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources
33RISK
open ↗
Referência✓ VexDay Proof
AutoDealer 2.0 - 'detail.asp?iPro' SQL Injection
CVE-2007-0053—webappsasp
SQL injection vulnerability in detail.asp in ASP SiteWare autoDealer 2.0 and earlier allows remote attackers to execute
23RISK
open ↗
Referência
CVE-2013-6232
CVE-2013-6232—
Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web
23RISK
open ↗
Referência
CVE-2013-6236
CVE-2013-6236—
IZON IP 2.0.2: hard-coded password vulnerability
28RISK
open ↗
Referência
CVE-2026-109175
CVE-2026-109175MEDIUM
MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList
33RISK
open ↗
Referência
CVE-2026-109166
CVE-2026-109166HIGH
lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById
41RISK
open ↗
Referência
CVE-2026-109165
CVE-2026-109165MEDIUM
TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create
33RISK
open ↗
Referência
CVE-2026-108827
CVE-2026-108827LOW
Zen Cart Administrative Module Management general.php zen_call_function code injection
28RISK
open ↗
Referência
CVE-2026-108878
CVE-2026-108878MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/app/queryById
33RISK
open ↗
Referência
CVE-2019-6272
CVE-2019-6272—
Command injection vulnerability in login_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attacker
28RISK
open ↗
Referência
CVE-2026-94295
CVE-2026-94295MEDIUM
Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature
33RISK
open ↗
Referência
CVE-2026-76556
CVE-2026-76556MEDIUM
WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter Rules
33RISK
open ↗
Referência
CVE-2026-80072
CVE-2026-80072MEDIUM
User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters
33RISK
open ↗
Referência
CVE-2026-86780
CVE-2026-86780MEDIUM
Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text
33RISK
open ↗
Referência
CVE-2026-78151
CVE-2026-78151MEDIUM
FormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response
33RISK
open ↗
Referência
CVE-2026-77788
CVE-2026-77788MEDIUM
Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas
33RISK
open ↗
Referência
CVE-2026-82631
CVE-2026-82631LOW
valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free
28RISK
open ↗
Referência
CVE-2026-82629
CVE-2026-82629MEDIUM
jeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload
33RISK
open ↗
Referência
CVE-2026-104682
CVE-2026-104682LOW
Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route
28RISK
open ↗
Referência
CVE-2026-82623
CVE-2026-82623MEDIUM
open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free
33RISK
open ↗
Referência
CVE-2026-77018
CVE-2026-77018HIGH
Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment
41RISK
open ↗
Referência
CVE-2026-86406
CVE-2026-86406HIGH
User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase
41RISK
open ↗
Referência
CVE-2026-116044
CVE-2026-116044MEDIUM
prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload
33RISK
open ↗
Referência
CVE-2026-116007
CVE-2026-116007MEDIUM
YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication
33RISK
open ↗
Referência
CVE-2026-104681
CVE-2026-104681LOW
Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field
28RISK
open ↗
Referência
CVE-2026-104680
CVE-2026-104680HIGH
Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard
41RISK
open ↗
Referência
CVE-2018-6084
CVE-2018-6084—
Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local
23RISK
open ↗
Referência
CVE-2026-103695
CVE-2026-103695HIGH
Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameter
41RISK
open ↗
Referência
CVE-2026-108539
CVE-2026-108539MEDIUM
GPAC MP4Box filter_queue.c gf_fq_pop use after free
33RISK
open ↗
← previouspage 550 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.