Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2017-14845
CVE-2017-14845—
Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.
23RISK
open ↗
Referência
CVE-2017-14846
CVE-2017-14846—
Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.
23RISK
open ↗
Referência
CVE-2018-25379
CVE-2018-25379HIGH
Collectric CMU 1.0 SQL Injection via lang Parameter
41RISK
open ↗
Referência
CVE-2026-9435
CVE-2026-9435CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setQosCfg os command injection
48RISK
open ↗
Referência
CVE-2026-9417
CVE-2026-9417MEDIUM
code-projects Employee Management System myprofileup.php cross site scripting
33RISK
open ↗
Referência
CVE-2020-11023
CVE-2020-11023MEDIUMunder attack
Potential XSS vulnerability in jQuery
85RISK
open ↗
Referência✓ VexDay Proof
mxBB Module mx_tinies 1.3.0 - Remote File Inclusion
CVE-2006-6295—webappsphp
PHP remote file inclusion vulnerability in includes/mx_common.php in the mx_tinies 1.3.0 Module for MxBB Portal 1.06 all
23RISK
open ↗
Referência
LimeSurvey 4.1.11 - 'Survey Groups' Persistent Cross-Site Scripting
CVE-2020-11456—webappsphp
LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and applicati
45RISK
open ↗
Referência
CVE-2015-1362
CVE-2015-1362—
Buffer overflow in the Customize 35mm tab in Two Pilots Exif Pilot 4.7.2 allows remote attackers to execute arbitrary co
23RISK
open ↗
Referência
CVE-2015-1389
CVE-2015-1389—
Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote at
23RISK
open ↗
Referência
CVE-2026-80049
CVE-2026-80049HIGH
Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId
41RISK
open ↗
Referência
CVE-2026-79623
CVE-2026-79623MEDIUM
FishCodeTech Muteki Default Local Worker Backend settings.json os command injection
33RISK
open ↗
Referência
RAD SecFlow-1v SF_0290_2.3.01.26 - Cross-Site Request Forgery (Reboot)
CVE-2020-13259—webappshardware
A vulnerability in the web-based management interface of RAD SecFlow-1v os-image SF_0290_2.3.01.26 could allow an unauth
23RISK
open ↗
Referência
CVE-2015-1833
CVE-2015-1833—
XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.
35RISK
open ↗
Referência
CVE-2026-80051
CVE-2026-80051MEDIUM
github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its
33RISK
open ↗
Referência✓ VexDay Proof
Ipswitch WS_FTP Server with SSH 6.1.0.0 - Remote Buffer Overflow (PoC)
CVE-2008-0590—doswindows
Buffer overflow in Ipswitch WS_FTP Server with SSH 6.1.0.0 allows remote authenticated users to cause a denial of servic
28RISK
open ↗
Referência
CVE-2026-72714 — Rocq Universe Checking State Desynchronised After Module Close
CVE-2026-72714MEDIUM
Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close
33RISK
open ↗
Referência
CVE-2026-108704
CVE-2026-108704MEDIUM
CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints
33RISK
open ↗
Referência
CVE-2015-2094
CVE-2015-2094—
Stack-based buffer overflow in the WESPPlayback.WESPPlaybackCtrl.1 control in WebGate WinRDS allows remote attackers to
28RISK
open ↗
Referência
CVE-2017-15963
CVE-2017-15963—
iTech Gigs Script 1.21 allows SQL Injection via the browse-scategory.php sc parameter or the service-provider.php ser pa
23RISK
open ↗
Referência✓ VexDay Proof
Linux Kernel 2.6.17 < 2.6.24.1 - 'vmsplice' Local Privilege Escalation (2)
CVE-2008-0600—locallinux
The vmsplice_to_pipe function in Linux kernel 2.6.17 through 2.6.24.1 does not validate a certain userspace pointer befo
23RISK
open ↗
Referência
CVE-2015-2102
CVE-2015-2102—
SQL injection vulnerability in view_item.php in ClipBucket 2.7 RC3 (2.7.0.4.v2929-rc3) allows remote attackers to execut
23RISK
open ↗
Referência
CVE-2017-15976
CVE-2017-15976—
ZeeBuddy 2x allows SQL Injection via the admin/editadgroup.php groupid parameter, a different vulnerability than CVE-200
23RISK
open ↗
Referência
CVE-2026-108703
CVE-2026-108703MEDIUM
CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push
33RISK
open ↗
Referência
CVE-2026-108653
CVE-2026-108653MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via GET /openapi/list
33RISK
open ↗
Referência
CVE-2017-15986
CVE-2017-15986—
CPA Lead Reward Script allows SQL Injection via the username parameter.
23RISK
open ↗
Referência
CVE-2017-17581
CVE-2017-17581—
FS Quibids Clone 1.0 has SQL Injection via the itechd.php productid parameter.
23RISK
open ↗
Referência
CVE-2017-17583
CVE-2017-17583—
FS Shutterstock Clone 1.0 has SQL Injection via the /Category keywords parameter.
23RISK
open ↗
Referência
CVE-2017-17583
CVE-2017-17583—
FS Shutterstock Clone 1.0 has SQL Injection via the /Category keywords parameter.
23RISK
open ↗
Referência
CVE-2017-17584
CVE-2017-17584—
FS Makemytrip Clone 1.0 has SQL Injection via the show-flight-result.php fl_orig or fl_dest parameter.
23RISK
open ↗
← previouspage 565 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.