Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits

40,553CVEs with public exploitation

24,696lab-tested

All Referência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecent popular risk

26,327 exploits

Referência

CVE-2026-19770

CVE-2026-19770MEDIUM

feedmob fm-mcp-servers Download Endpoint index.ts downloadReport server-side request forgery

33RISK

open ↗

Referência

CVE-2017-15973

CVE-2017-15973—

Sokial Social Network Script 1.0 allows SQL Injection via the id parameter to admin/members_view.php.

23RISK

open ↗

Referência

CVE-2026-77148

CVE-2026-77148CRITICAL

Comfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflow

48RISK

open ↗

Referência

CVE-2026-19699

CVE-2026-19699LOW

GutenKit 2.4.12 - 2.4.15 - Contributor+ Mailchimp Audience Data Disclosure

28RISK

open ↗

Referência

CVE-2017-17589

CVE-2017-17589—

FS Thumbtack Clone 1.0 has SQL Injection via the browse-category.php cat parameter or the browse-scategory.php sc parame

23RISK

open ↗

Referência

CVE-2017-17589

CVE-2017-17589—

FS Thumbtack Clone 1.0 has SQL Injection via the browse-category.php cat parameter or the browse-scategory.php sc parame

23RISK

open ↗

Referência

CVE-2017-17592

CVE-2017-17592—

Website Auction Marketplace 2.0.5 has SQL Injection via the search.php cat_id parameter.

23RISK

open ↗

Referência✓ VexDay Proof

SQuery 4.5 - 'libpath' Remote File Inclusion

CVE-2006-1610—webappsphp

PHP remote file inclusion vulnerability in lib/armygame.php in SQuery 4.5 and earlier, as used in products such as Auton

23RISK

open ↗

Referência

CVE-2015-2844

CVE-2015-2844—

The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1420434000 allows remote attackers to execute arb

28RISK

open ↗

Referência

CVE-2026-61518

CVE-2026-61518HIGH

ISPConfig Authenticated SQL Injection via Remote API primary_id Parameter

41RISK

open ↗

Referência

CVE-2015-2845

CVE-2015-2845—

The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1421902800 allows remote attackers to execute arb

60RISK

open ↗

Referência

CVE-2026-72844

CVE-2026-72844MEDIUM

Lean 4 Kernel Type Checking Bypass via Mismatched Structure Projections

33RISK

open ↗

Referência

CVE-2026-77022

CVE-2026-77022CRITICAL

Comfast CF-N1-S SSID Configuration mbox-config sub_44B438 stack-based overflow

48RISK

open ↗

Referência

CVE-2026-19697

CVE-2026-19697MEDIUM

GutenKit < 2.5.0 - Author+ Stored XSS via SVG Upload

33RISK

open ↗

Referência

CVE-2015-2845

CVE-2015-2845—

The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1421902800 allows remote attackers to execute arb

60RISK

open ↗

Referência

CVE-2015-2878

CVE-2015-2878—

Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijac

23RISK

open ↗

Referência

CVE-2017-17622

CVE-2017-17622—

Online Exam Test Application Script 1.6 has SQL Injection via the exams.php sort parameter.

23RISK

open ↗

Referência

CVE-2017-17625

CVE-2017-17625—

Professional Service Script 1.0 has SQL Injection via the service-list city parameter.

23RISK

open ↗

Referência

CVE-2013-5316

CVE-2013-5316—

Cross-site request forgery (CSRF) vulnerability in RiteCMS 1.0.0 allows remote attackers to hijack the authentication of

23RISK

open ↗

Referência

CVE-2015-5116

CVE-2015-5116—

Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481

28RISK

open ↗

Referência

CVE-2015-5065

CVE-2015-5065—

Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic

28RISK

open ↗

Referência

CVE-2020-15922

CVE-2020-15922—

There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE)

35RISK

open ↗

Referência

Opmon 9.11 - Cross-site Scripting

CVE-2021-43009—remotemultiple

A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the reque

23RISK

open ↗

Referência

CVE-2022-50964

CVE-2022-50964MEDIUM

uBidAuction 2.0.1 myAuctions loose Reflected XSS

33RISK

open ↗

Referência

CVE-2022-50964

CVE-2022-50964MEDIUM

uBidAuction 2.0.1 myAuctions loose Reflected XSS

33RISK

open ↗

Referência

CVE-2022-50963

CVE-2022-50963MEDIUM

uBidAuction 2.0.1 myAuctions active Reflected XSS

33RISK

open ↗

Referência

CVE-2022-50963

CVE-2022-50963MEDIUM

uBidAuction 2.0.1 myAuctions active Reflected XSS

33RISK

open ↗

Referência

CVE-2022-50960

CVE-2022-50960MEDIUM

WordPress International Sms Contact Form 7 Integration 1.2 XSS

33RISK

open ↗

Referência

CVE-2022-50959

CVE-2022-50959MEDIUM

WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php

33RISK

open ↗

Referência

CVE-2022-50958

CVE-2022-50958MEDIUM

WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.php

33RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.