Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-14931
CVE-2026-14931MEDIUM
JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure
33RISK
open ↗
Referência✓ VexDay Proof
Webmin 1.910 - 'Package Updates' Remote Command Execution (Metasploit)
CVE-2019-12840—remotelinux
In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root pr
60RISK
open ↗
Referência
CVE-2019-13272
CVE-2019-13272HIGHunder attack
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proce
98RISK
open ↗
Referência
CVE-2026-115981
CVE-2026-115981MEDIUM
phpIPAM index.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-69118
CVE-2026-69118HIGH
Cachet 2.4.1 Authenticated Server-Side Template Injection RCE
41RISK
open ↗
Referência
CVE-2026-64822
CVE-2026-64822MEDIUM
djangoSIGE 1.10 User Enumeration via ForgotPasswordView
33RISK
open ↗
Referência
CVE-2026-13694
CVE-2026-13694MEDIUM
Bit Form < 3.1.0 - Unauthenticated Workflow Trigger via Authentication Bypass
33RISK
open ↗
Referência
CVE-2026-13693
CVE-2026-13693MEDIUM
Bit Form < 3.1.0 - Unauthenticated Arbitrary File Read via Path Traversal
33RISK
open ↗
Referência
CVE-2023-47268
CVE-2023-47268MEDIUM
In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrar
33RISK
open ↗
Referência
CVE-2024-46508
CVE-2024-46508HIGH
yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting
41RISK
open ↗
Referência
CVE-2026-18934
CVE-2026-18934MEDIUM
RSS Aggregator by Feedzy < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion
33RISK
open ↗
Referência
CVE-2026-113492
CVE-2026-113492MEDIUM
GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action
33RISK
open ↗
Referência
CVE-2026-18606
CVE-2026-18606HIGH
Razer RzUpdateService Named Pipe RzUpdateService.exe privileges management
41RISK
open ↗
Referência
CVE-2026-39932
CVE-2026-39932CRITICAL
OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection
48RISK
open ↗
Referência
CVE-2026-113491
CVE-2026-113491MEDIUM
GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal
33RISK
open ↗
Referência
CVE-2018-25410
CVE-2018-25410HIGH
SIM-PKH 2.4.1 SQL Injection via media.php id Parameter
41RISK
open ↗
Referência
CVE-2018-25409
CVE-2018-25409HIGH
SIM-PKH 2.4.1 Arbitrary File Upload via aksi_pengurus.php
41RISK
open ↗
Referência
CVE-2019-14348
CVE-2019-14348—
The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via
28RISK
open ↗
Referência
CVE-2026-9405
CVE-2026-9405CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection
48RISK
open ↗
Referência
CVE-2026-9381
CVE-2026-9381HIGH
Edimax BR-6675nD POST Request formPPPoESetup buffer overflow
41RISK
open ↗
Referência
CVE-2026-9380
CVE-2026-9380HIGH
Edimax BR-6675nD POST Request formL2TPSetup buffer overflow
41RISK
open ↗
Referência
CVE-2018-25408
CVE-2018-25408HIGH
The Open ISES Project 3.30A Path Traversal Arbitrary File Download
41RISK
open ↗
Referência
CVE-2026-12808
CVE-2026-12808MEDIUM
Edimax BR-6478AC V2 POST Request stainfo command injection
33RISK
open ↗
Referência
CVE-2026-12787
CVE-2026-12787MEDIUM
zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testConnection Endpoint deserialization
33RISK
open ↗
Referência
CVE-2018-19246
CVE-2018-19246—
PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users w
28RISK
open ↗
Referência
CVE-2016-20095
CVE-2016-20095HIGH
Matrix42 Remote Control Host 3.20.0031 Unquoted Path Privilege Escalation
41RISK
open ↗
Referência
CVE-2016-20094
CVE-2016-20094HIGH
AnyDesk 2.5.0 Unquoted Service Path Elevation of Privilege
41RISK
open ↗
Referência
CVE-2026-11447
CVE-2026-11447MEDIUM
GL.iNet GL-MT3000 MTK Backend iwinfo.so iwinfo_backend command injection
33RISK
open ↗
Referência
CVE-2026-50656
CVE-2026-50656HIGH
Microsoft Defender Elevation of Privilege Vulnerability
46RISK
open ↗
Referência
CVE-2018-25407
CVE-2018-25407HIGH
eNdonesia Portal 8.7 SQL Injection via mod.php
41RISK
open ↗
← previouspage 560 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.