Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-15385
CVE-2026-15385MEDIUM
RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS
33RISK
open ↗
Referência
CVE-2026-103090
CVE-2026-103090HIGH
Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)
41RISK
open ↗
Referência
CVE-2026-86183
CVE-2026-86183MEDIUM
diem-project diem dmWidget BasedmWidgetActions.class.php authorization
33RISK
open ↗
Referência
CVE-2026-81737
CVE-2026-81737HIGH
FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information
41RISK
open ↗
Referência
CVE-2026-19345
CVE-2026-19345MEDIUM
code-projects Task Management System UpdateTaskStatus.php authorization
33RISK
open ↗
Referência
CVE-2026-87069
CVE-2026-87069LOW
Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe
28RISK
open ↗
Referência
CVE-2026-94096
CVE-2026-94096CRITICAL
Netcore NBR200V2 LAN IP Configuration network_tools command injection
48RISK
open ↗
Referência
CVE-2026-77884
CVE-2026-77884HIGH
Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposure
41RISK
open ↗
Referência
CVE-2026-82596
CVE-2026-82596MEDIUM
LatencyUtils PauseDetector LatencyStats.java LatencyStats.recordDetectedPause memory corruption
33RISK
open ↗
Referência
CVE-2026-18722
CVE-2026-18722MEDIUM
diaowen DWSurvey dev-survey.do in DwDeisgnSurveyController.devSurvey. authorization
33RISK
open ↗
Referência
CVE-2026-16057
CVE-2026-16057MEDIUM
Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library
33RISK
open ↗
Referência
CVE-2026-19862
CVE-2026-19862MEDIUM
JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action
33RISK
open ↗
Referência
CVE-2026-86209
CVE-2026-86209MEDIUM
SourceCodester Class and Exam Timetabling System delete_user.php sql injection
33RISK
open ↗
Referência
CVE-2026-112152
CVE-2026-112152MEDIUM
vraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injection
33RISK
open ↗
Referência
CVE-2026-112086
CVE-2026-112086MEDIUM
ESPnet Inference Model inference_model.py build_model deserialization
33RISK
open ↗
Referência
CVE-2026-106933
CVE-2026-106933MEDIUM
Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload
33RISK
open ↗
Referência
CVE-2026-106028
CVE-2026-106028MEDIUM
ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation
33RISK
open ↗
Referência
CVE-2026-111874
CVE-2026-111874MEDIUM
OpenCATS Career Portal CareersUI.php processLogin excessive authentication
33RISK
open ↗
Referência
CVE-2022-40022
CVE-2022-40022CRITICAL
Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.
85RISK
open ↗
Referência
CVE-2021-40870
CVE-2021-40870CRITICALunder attack
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous
100RISK
open ↗
Referência✓ VexDay Proof
Core Image Fun House 2.0 (OSX) - Arbitrary Code Execution (PoC)
CVE-2008-2304—dososx
Buffer overflow in Apple Core Image Fun House 2.0 and earlier in CoreImage Examples in Xcode tools before 3.1 allows use
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component beamospetition 1.0.12 - SQL Injection / Cross-Site Scripting
CVE-2009-0378—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in the beamospetition (com_beamospetition) 1.0.12 component for Jo
23RISK
open ↗
Referência
CVE-2010-3206
CVE-2010-3206—
Multiple PHP remote file inclusion vulnerabilities in DiY-CMS 1.0 allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗
Referência
CVE-2018-11138
CVE-2018-11138CRITICALunder attackransomware
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
100RISK
open ↗
Referência
CVE-2019-8943
CVE-2019-8943—
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can
60RISK
open ↗
Referência
CVE-2023-31069
CVE-2023-31069—
An issue was discovered in TSplus Remote Access through 16.0.2.14. Credentials are stored as cleartext within the HTML s
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module resmanager 1.21 - Blind SQL Injection
CVE-2007-2735—webappsphp
SQL injection vulnerability in edit_day.php in the ResManager 1.2.1 and earlier module for Xoops allows remote attackers
23RISK
open ↗
Referência
CVE-2017-12629
CVE-2017-12629—
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction wi
60RISK
open ↗
Referência✓ VexDay Proof
IBM Domino Web Access 7.0 Upload Module - 'inotes6.dll' Remote Buffer Overflow
CVE-2007-4474—remotewindows
Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, in
50RISK
open ↗
Referência
ManageEngine Applications Manager 11.0 < 14.0 - SQL Injection / Remote Code Execution (Metasploit)
CVE-2019-11448—remotewindows
An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain th
28RISK
open ↗
← previouspage 562 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.