Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2025-15546
CVE-2025-15546MEDIUM
Iptanus File Upload < 5.1.7 - File Overwrite via Race Condition
33RISK
open ↗
Referência
CVE-2026-10292
CVE-2026-10292HIGH
UTT HiPER 1200GW formTaskEdit strcpy stack-based overflow
41RISK
open ↗
Referência
CVE-2026-25557
CVE-2026-25557MEDIUM
Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter
33RISK
open ↗
Referência
CVE-2026-10290
CVE-2026-10290MEDIUM
code-projects Hotel and Tourism Reservation System GET Parameter tour.php sql injection
33RISK
open ↗
Referência
CVE-2026-10289
CVE-2026-10289MEDIUM
code-projects Hotel and Tourism Reservation System tour.php cross site scripting
33RISK
open ↗
Referência
CVE-2014-125138
CVE-2014-125138HIGH
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields
41RISK
open ↗
Referência
CVE-2014-125138
CVE-2014-125138HIGH
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields
41RISK
open ↗
Referência
CVE-2014-125138
CVE-2014-125138HIGH
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields
41RISK
open ↗
Referência
CVE-2026-10217
CVE-2026-10217MEDIUM
nextlevelbuilder GoClaw RoleAdmin Gateway tts_config.go handleSave privileges management
33RISK
open ↗
Referência
CVE-2026-10216
CVE-2026-10216MEDIUM
unitedbyai droidclaw claim Endpoint pairing.ts excessive authentication
33RISK
open ↗
Referência
CVE-2026-10215
CVE-2026-10215MEDIUM
Dolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorization
33RISK
open ↗
Referência
CVE-2026-10214
CVE-2026-10214MEDIUM
zhayujie chatgpt-on-wechat Bash Tool bash.py _get_safety_warning os command injection
33RISK
open ↗
Referência
CVE-2026-10213
CVE-2026-10213MEDIUM
AstrBotDevs AstrBot API Endpoint delete path traversal
33RISK
open ↗
Referência
CVE-2026-10203
CVE-2026-10203MEDIUM
OFCMS JSON Query SystemParamController.java query sql injection
33RISK
open ↗
Referência
CVE-2026-10192
CVE-2026-10192HIGH
Tenda W12 httpd set_local_time_0 stack-based overflow
41RISK
open ↗
Referência
CVE-2026-10294
CVE-2026-10294MEDIUM
PackageKit API pk-transaction.c g_file_test improper authorization
33RISK
open ↗
Referência
CVE-2026-10250
CVE-2026-10250MEDIUM
itsourcecode Online Blood Bank Management System campsdetails.php sql injection
33RISK
open ↗
Referência
CVE-2026-10287
CVE-2026-10287MEDIUM
SourceCodester SEO Meta Tag Extractor index.php get_headers server-side request forgery
33RISK
open ↗
Referência
CVE-2026-10219
CVE-2026-10219MEDIUM
nextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injection
33RISK
open ↗
Referência
CVE-2026-10218
CVE-2026-10218MEDIUM
nextlevelbuilder GoClaw evolution_handlers.go auth improper authorization
33RISK
open ↗
Referência
CVE-2018-19571
CVE-2018-19571—
GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an
35RISK
open ↗
Referência✓ VexDay Proof
more.groupware 0.74 - 'new_calendarid' SQL Injection
CVE-2006-4906—webappsphp
SQL injection vulnerability in modules/calendar/week.php in More.groupware 0.74 allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Highwood Design hwdVideoShare - SQL Injection
CVE-2008-0916—webappsphp
SQL injection vulnerability in the Highwood Design hwdVideoShare (com_hwdvideoshare) 1.1.3 Alpha component for Joomla!
23RISK
open ↗
Referência✓ VexDay Proof
CafeEngine - Multiple SQL Injections
CVE-2008-4605—webappsphp
SQL injection vulnerability in CafeEngine allows remote attackers to execute arbitrary SQL commands via the id parameter
23RISK
open ↗
Referência✓ VexDay Proof
Ultimate WebBoard 3.00 - 'Category' SQL Injection
CVE-2008-4666—webappsphp
SQL injection vulnerability in webboard.php in Ultimate Webboard 3.00 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2026-10258
CVE-2026-10258MEDIUM
itsourcecode Content Management System add_sub_topic.php sql injection
33RISK
open ↗
Referência
CVE-2026-10253
CVE-2026-10253MEDIUM
itsourcecode Online House Rental System manage_payment.php sql injection
33RISK
open ↗
Referência
CVE-2026-10251
CVE-2026-10251MEDIUM
itsourcecode Online House Rental System ajax.php login sql injection
33RISK
open ↗
Referência
CVE-2026-116118
CVE-2026-116118MEDIUM
Z.ai Zcode Sed Command Filter os command injection
33RISK
open ↗
Referência
CVE-2026-10111
CVE-2026-10111MEDIUM
sambitraj STUDENT-MANAGEMENT-SYSTEM Login Page sql injection
33RISK
open ↗
← previouspage 576 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.