Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-87896
Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route
33RISK
open ↗Referência
CVE-2026-87860
Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF
33RISK
open ↗Referência
CVE-2026-15229
Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation
33RISK
open ↗Referência
CVE-2026-18960
Block User Account < 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords
33RISK
open ↗Referência
CVE-2017-8841
Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b30
23RISK
open ↗Referência✓ VexDay Proof
X7 Chat 2.0.4 - 'old_prefix' Blind SQL Injection
SQL injection vulnerability in upgradev1.php in X7 Chat 2.0.4 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗Referência
CVE-2017-8852
SAP SAPCAR 721.510 has a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted CAR archive file
23RISK
open ↗Referência
CVE-2026-11870
Hide My WP Ghost < 7.0.05 - IP Address Spoofing via Trusted Proxy Headers Leading to Protection Mechanism Bypass
33RISK
open ↗Referência
CVE-2020-3952
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Servi
100RISK
open ↗Referência
CVE-2026-67206
Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload
41RISK
open ↗Referência✓ VexDay Proof
Mambo Component 'com_a6mambohelpdesk' 18RC1 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin.a6mambohelpdesk.php in a6mambohelpdesk Mambo Component 18RC1 and earlie
23RISK
open ↗Referência
CVE-2026-11867
Frontend Admin by DynamiApps < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/Deletion via Missing Authorization
33RISK
open ↗Referência
CVE-2026-15368
Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration
41RISK
open ↗Referência✓ VexDay Proof
eXtremail 2.1.1 - DNS Parsing Bugs Remote (PoC)
Stack-based buffer overflow in eXtremail 2.1.1 and earlier allows remote attackers to execute arbitrary code via a long
23RISK
open ↗Referência
CVE-2026-15244
HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_view
41RISK
open ↗Referência
CVE-2026-14836
Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limit Bypass
41RISK
open ↗Referência
CVE-2026-15382
Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Deletion via delete-bsf-fonts
33RISK
open ↗Referência
CVE-2026-14596
DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Link Host Injection
41RISK
open ↗Referência
CVE-2026-14309
Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypass
41RISK
open ↗Referência
CVE-2015-8644
Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on
28RISK
open ↗Referência
CVE-2016-0953
Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to exec
28RISK
open ↗Referência
CVE-2018-15139
Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote
28RISK
open ↗Referência
CVE-2018-16763
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca
60RISK
open ↗Referência
CVE-2018-17057
An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar://
28RISK
open ↗Referência
CVE-2018-19371
The SaveUserSettings service in Content Manager in SDL Web 8.5.0 has an XXE Vulnerability that allows reading sensitive
23RISK
open ↗Referência
CVE-2017-9413
Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attacke
23RISK
open ↗Referência
CVE-2017-9413
Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attacke
23RISK
open ↗Referência
Rukovoditel Project Management CRM 2.3.1 - Remote Code Execution (Metasploit)
A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a
23RISK
open ↗Referência✓ VexDay Proof
k_fileManager 1.2 - 'dwl_include_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in index.php in Knusperleicht FileManager 1.2 and earlier allow remot
23RISK
open ↗Referência✓ VexDay Proof
Voodoo chat 1.0RC1b - 'file_path' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in Vlad Vostrykh Voodoo chat 1.0RC1b and earlier allows remote atta
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.