Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-111991
CVE-2026-111991MEDIUM
WongKinYiu yolov9 ONNX Metadata common.py DetectMultiBackend.__init__ code injection
33RISK
open ↗
Referência
CVE-2021-41878
CVE-2021-41878—
A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enable
38RISK
open ↗
Referência
CVE-2021-42013
CVE-2021-42013CRITICALunder attackransomware
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RISK
open ↗
Referência
Open-AudIT 3.3.0 - Reflective Cross-Site Scripting (Authenticated)
CVE-2020-12261—webappsphp
Open-AudIT 3.3.0 allows an XSS attack after login.
23RISK
open ↗
Referência
CVE-2020-13693
CVE-2020-13693—
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Regi
35RISK
open ↗
Referência
CVE-2026-105195
CVE-2026-105195LOW
Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure
28RISK
open ↗
Referência
CVE-2026-103646
CVE-2026-103646CRITICAL
Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter
48RISK
open ↗
Referência
CVE-2026-107269
CVE-2026-107269MEDIUM
Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy
33RISK
open ↗
Referência
CVE-2026-112039
CVE-2026-112039MEDIUM
diem-project diem Administrative Console actions.class.php append cross site scripting
33RISK
open ↗
Referência
CVE-2014-4613
CVE-2014-4613—
Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attacke
23RISK
open ↗
Referência
CVE-2026-111990
CVE-2026-111990MEDIUM
kishan0725 Hospital Management System Appointment Cancellation admin-panel.php mysqli_query sql injection
33RISK
open ↗
Referência
CVE-2026-111987
CVE-2026-111987MEDIUM
AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scripting
33RISK
open ↗
Referência
CVE-2026-111986
CVE-2026-111986MEDIUM
AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection
33RISK
open ↗
Referência
CVE-2026-111985
CVE-2026-111985MEDIUM
AUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd_models.py read_metadata_from_safetensors allocation of resources
33RISK
open ↗
Referência
CVE-2026-111984
CVE-2026-111984MEDIUM
AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting
33RISK
open ↗
Referência
CVE-2026-112042
CVE-2026-112042MEDIUM
diem-project diem dmWidget dmBaseLinkTag.php text cross site scripting
33RISK
open ↗
Referência
CVE-2026-112041
CVE-2026-112041MEDIUM
diem-project diem dmString.php random weak prng
33RISK
open ↗
Referência
CVE-2026-112040
CVE-2026-112040MEDIUM
diem-project diem Sign-In BasedmUserActions.class.php redirect
33RISK
open ↗
Referência
CVE-2026-112038
CVE-2026-112038MEDIUM
diem-project diem Version Check Service dmAdminCtrl.js html cross site scripting
33RISK
open ↗
Referência
CVE-2026-112037
CVE-2026-112037MEDIUM
diem-project diem Google Analytics Client gapi.class.php certificate validation
33RISK
open ↗
Referência
CVE-2026-112036
CVE-2026-112036MEDIUM
Artifex MuPDF Signature Locking pdf-xref.c free_char_list double free
33RISK
open ↗
Referência
CVE-2026-112035
CVE-2026-112035MEDIUM
aircheng-org iWebShop-5 simple.php send_message_mobile password recovery
33RISK
open ↗
Referência
CVE-2026-112034
CVE-2026-112034MEDIUM
aircheng-org iWebShop-5 Login Redirect _userInfo.php redirect
33RISK
open ↗
Referência
CVE-2026-103305
CVE-2026-103305HIGH
Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update
41RISK
open ↗
Referência
CVE-2026-108708
CVE-2026-108708HIGH
Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil
41RISK
open ↗
Referência
CVE-2022-45030
CVE-2022-45030HIGH
A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may
41RISK
open ↗
Referência
CVE-2022-47076
CVE-2022-47076HIGH
An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to view sensitive information via Display
41RISK
open ↗
Referência
CVE-2022-47529
CVE-2022-47529—
Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Wi
23RISK
open ↗
Referência
CVE-2026-105194
CVE-2026-105194MEDIUM
Easy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Downloads Block
33RISK
open ↗
Referência
CVE-2026-107273
CVE-2026-107273MEDIUM
Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site
33RISK
open ↗
← previouspage 568 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.