Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2016-0861
CVE-2016-0861—
General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authentica
28RISK
open ↗
Referência
CVE-2016-10033
CVE-2016-10033CRITICALunder attack
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RISK
open ↗
Referência
CVE-2026-106095
CVE-2026-106095LOW
Code Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet
28RISK
open ↗
Referência
CVE-2016-1719
CVE-2016-1719—
The IOHIDFamily API in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain pri
23RISK
open ↗
Referência
CVE-2016-1719
CVE-2016-1719—
The IOHIDFamily API in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain pri
23RISK
open ↗
Referência
CVE-2026-105260
CVE-2026-105260MEDIUM
Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF
33RISK
open ↗
Referência
CVE-2026-105198
CVE-2026-105198MEDIUM
LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR
33RISK
open ↗
Referência
CVE-2026-86850
CVE-2026-86850MEDIUM
SKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation Deletion
33RISK
open ↗
Referência
CVE-2026-107695
CVE-2026-107695HIGH
FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist
41RISK
open ↗
Referência
CVE-2026-9209
CVE-2026-9209CRITICAL
mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx
48RISK
open ↗
Referência
CVE-2026-86826
CVE-2026-86826MEDIUM
BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX
33RISK
open ↗
Referência
CVE-2016-1719
CVE-2016-1719—
The IOHIDFamily API in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain pri
23RISK
open ↗
Referência
CVE-2026-105990
CVE-2026-105990MEDIUM
Accept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via CSV Export
33RISK
open ↗
Referência
CVE-2026-94536
CVE-2026-94536MEDIUM
lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource
33RISK
open ↗
Referência
CVE-2026-105706
CVE-2026-105706MEDIUM
SourceCodester Drug Recommendation System cross-site request forgery
33RISK
open ↗
Referência
CVE-2026-105705
CVE-2026-105705MEDIUM
SourceCodester Drug Recommendation System add_drug.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-105704
CVE-2026-105704MEDIUM
SourceCodester Drug Recommendation System Auth Guard improper authentication
33RISK
open ↗
Referência
CVE-2026-105703
CVE-2026-105703MEDIUM
PHPGurukul User Registration & Login and User Management System Change Password change-password.php authorization
33RISK
open ↗
Referência✓ VexDay Proof
Sun Board 1.00.00 alpha - Remote File Inclusion
CVE-2007-3370—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Sun Board 1.00.00 Alpha allow remote attackers to execute arbitrar
45RISK
open ↗
Referência✓ VexDay Proof
Prozilla Directory Script - 'Directory.php?cat_id' SQL Injection
CVE-2007-3809—webappsphp
Multiple SQL injection vulnerabilities in Prozilla Directory Script allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
Realtor 747 - 'index.php?categoryId' SQL Injection
CVE-2007-3810—webappsphp
SQL injection vulnerability in index.php in Realtor 747 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência✓ VexDay Proof
eSyndiCat Directory Software - Multiple SQL Injections
CVE-2007-3811—webappsphp
Multiple SQL injection vulnerabilities in eSyndiCat allow remote attackers to execute arbitrary SQL commands via (1) the
23RISK
open ↗
Referência
CVE-2016-1846
CVE-2016-1846—
The nvCommandQueue::GetHandleIndex method in the NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows a
23RISK
open ↗
Referência
CVE-2026-84066
CVE-2026-84066LOW
Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload
28RISK
open ↗
Referência
CVE-2026-109444
CVE-2026-109444CRITICAL
OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection
48RISK
open ↗
Referência
CVE-2026-82194
CVE-2026-82194MEDIUM
WPvivid Backup & Migration < 0.9.134 - Admin+ Arbitrary File Deletion via Path Traversal
33RISK
open ↗
Referência
CVE-2026-96903
CVE-2026-96903MEDIUM
Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers
33RISK
open ↗
Referência
CVE-2026-96902
CVE-2026-96902MEDIUM
Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API
33RISK
open ↗
Referência
CVE-2026-109443
CVE-2026-109443HIGH
JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shell
41RISK
open ↗
Referência✓ VexDay Proof
WzdFTPD 0.8.0 - 'USER' Remote Denial of Service
CVE-2007-5300—doswindows
Off-by-one error in the do_login_loop function in libwzd-core/wzd_login.c in wzdftpd 0.8.0, 0.8.2, and possibly other ve
23RISK
open ↗
← previouspage 557 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.