Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-9566
CVE-2026-9566MEDIUM
teableio teable Sign-up LoginPage.tsx cross site scripting
33RISK
open ↗
Referência
CVE-2026-10124
CVE-2026-10124HIGH
Shibby Tomato Zserv ripd rip_zebra_read_ipv4 stack-based overflow
41RISK
open ↗
Referência
OpenSIS 8.0 'modname' - Directory Traversal
CVE-2021-40651—webappsphp
OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), wh
43RISK
open ↗
Referência
CVE-2026-9631
CVE-2026-9631HIGH
UTT HiPER 1250GW Web Management formConfigFastDirectionW strcpy stack-based overflow
41RISK
open ↗
Referência
CVE-2026-9628
CVE-2026-9628HIGH
UTT HiPER 1200GW Web Management formPptpClientConfig stack-based overflow
41RISK
open ↗
Referência✓ VexDay Proof
MVCnPHP 3.0 - glConf[path_libraries] Remote File Inclusion
CVE-2006-4160—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Tony Bibbs and Vincent Furia MVCnPHP 3.0 allow remote attackers to
23RISK
open ↗
Referência
CVE-2026-43634
CVE-2026-43634HIGH
HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header
41RISK
open ↗
Referência
CVE-2021-41382
CVE-2021-41382—
Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface.
23RISK
open ↗
Referência
CVE-2018-17378
CVE-2018-17378—
SQL Injection exists in the Penny Auction Factory 2.0.4 component for Joomla! via the filter_order_Dir or filter_order p
23RISK
open ↗
Referência
CVE-2026-23697
CVE-2026-23697HIGH
Vtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents Module
41RISK
open ↗
Referência
CVE-2021-41382
CVE-2021-41382—
Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface.
23RISK
open ↗
Referência
CVE-2026-15317
CVE-2026-15317MEDIUM
Sipeed PicoClaw Guarded Web Fetch Flow web.go WebFetchTool.Execute server-side request forgery
33RISK
open ↗
Referência
CVE-2026-15182
CVE-2026-15182MEDIUM
GNU LibreDWG BMP Image dwg.c dwg_bmp heap-based overflow
33RISK
open ↗
Referência
CVE-2026-8785
CVE-2026-8785MEDIUM
projectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection
33RISK
open ↗
Referência
CVE-2026-8755
CVE-2026-8755MEDIUM
fishaudio Bert-VITS2 Model hiyoriUI.py _get_all_models path traversal
33RISK
open ↗
Referência
CVE-2026-8754
CVE-2026-8754MEDIUM
AstrBotDevs AstrBot File Upload chat.py post_file path traversal
33RISK
open ↗
Referência
CVE-2018-25339
CVE-2018-25339HIGH
Zechat 1.5 SQL Injection via v parameter (time-based blind)
41RISK
open ↗
Referência
CVE-2018-25338
CVE-2018-25338HIGH
Zechat 1.5 SQL Injection via hashtag parameter
41RISK
open ↗
Referência
CVE-2018-25337
CVE-2018-25337MEDIUM
Joomla JoomOCShop 1.0 Cross-Site Request Forgery
33RISK
open ↗
Referência
CVE-2021-41773
CVE-2021-41773HIGHunder attackransomware
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
Referência
CVE-2026-11869
CVE-2026-11869MEDIUM
WP DSGVO Tools (GDPR) < 3.1.40 - Unauthenticated Sensitive Information Disclosure via Subject Access Request
33RISK
open ↗
Referência
CVE-2018-17378
CVE-2018-17378—
SQL Injection exists in the Penny Auction Factory 2.0.4 component for Joomla! via the filter_order_Dir or filter_order p
23RISK
open ↗
Referência
CVE-2018-17380
CVE-2018-17380—
SQL Injection exists in the Article Factory Manager 4.3.9 component for Joomla! via the start_date, m_start_date, or m_e
23RISK
open ↗
Referência
CVE-2018-17380
CVE-2018-17380—
SQL Injection exists in the Article Factory Manager 4.3.9 component for Joomla! via the start_date, m_start_date, or m_e
23RISK
open ↗
Referência
CVE-2026-89007
CVE-2026-89007LOW
Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization
28RISK
open ↗
Referência
CVE-2026-10248
CVE-2026-10248MEDIUM
SourceCodester Pharmacy Sales and Inventory System Supplier Creation export create_supplier csv injection
33RISK
open ↗
Referência
CVE-2026-10616
CVE-2026-10616MEDIUM
nextlevelbuilder GoClaw Team Task Completion team_tasks_lifecycle.go TeamTasksTool.executeComplete authorization
33RISK
open ↗
Referência
CVE-2021-47983
CVE-2021-47983MEDIUM
WordPress Plugin Stripe Payments < 2.0.40 Stored XSS via currency_code
33RISK
open ↗
Referência
CVE-2026-10264
CVE-2026-10264MEDIUM
lharries whatsapp-mcp Send API Endpoint main.go SendMessageRequest path traversal
33RISK
open ↗
Referência
CVE-2026-10256
CVE-2026-10256MEDIUM
itsourcecode Content Management System save_comment.php sql injection
33RISK
open ↗
← previouspage 569 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.