Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-16562
WP Statistics < 14.16.10 - Subscriber+ Sensitive Data Disclosure via Metabox AJAX Handlers
33RISK
open ↗Referência
CVE-2026-18592
osCommerce Email Template Configuration EmailController.php EmailController sql injection
33RISK
open ↗Referência✓ VexDay Proof
Songbird Media Player 0.2 - Format String Denial of Service (PoC)
Format string vulnerability in Songbird Media Player 0.2 and earlier allows remote attackers to cause a denial of servic
23RISK
open ↗Referência
CVE-2026-16060
Insert or Embed Articulate Content into WordPress <= 4.3000000027 - Editor+ Arbitrary File Upload
48RISK
open ↗Referência
CVE-2026-15240
Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution
41RISK
open ↗Referência
CVE-2026-14207
LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information
33RISK
open ↗Referência✓ VexDay Proof
CM68 News 12.02.06 - 'addpth' Remote File Inclusion
PHP remote file inclusion vulnerability in engine/oldnews.inc.php in CM68 News 12.02.06 allows remote attackers to execu
23RISK
open ↗Referência
CVE-2018-19371
The SaveUserSettings service in Content Manager in SDL Web 8.5.0 has an XXE Vulnerability that allows reading sensitive
23RISK
open ↗Referência
CVE-2026-12687
ProfileGrid < 5.9.9.8 - Unauthenticated Privilege Escalation via Unrestricted Group ID
41RISK
open ↗Referência✓ VexDay Proof
HR Assist 1.05 - 'vdateUsr.asp' Remote Authentication Bypass
SQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbit
23RISK
open ↗Referência✓ VexDay Proof
Gizzar 03162002 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in Gizzar 03162002 and earlier allows remote attackers to execute a
23RISK
open ↗Referência
CVE-2026-12436
Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab
41RISK
open ↗Referência
Savsoft Quiz 5 - Stored Cross-Site Scripting
TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the X
23RISK
open ↗Referência
CVE-2026-12982
Document Gallery < 5.1.1 - Reflected XSS via dg_generate_gallery
33RISK
open ↗Referência
CVE-2019-15975
Cisco Data Center Network Manager Authentication Bypass Vulnerabilities
85RISK
open ↗Referência
CVE-2020-24949
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a cr
50RISK
open ↗Referência
CVE-2026-10820
ProfilePress < 4.16.17 - Subscriber+ Subscription Cancellation via IDOR
41RISK
open ↗Referência
CVE-2016-20085
Realtek High Definition Audio Driver 6.0.1.6730 Privilege Escalation
41RISK
open ↗Referência
CVE-2026-87974
Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook
33RISK
open ↗Referência
CVE-2026-107158
LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST Route
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.