Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-12965
CVE-2026-12965CRITICAL
Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking
48RISK
open ↗
Referência
CVE-2020-28328
CVE-2020-28328—
SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain
50RISK
open ↗
Referência
CVE-2026-19978
CVE-2026-19978MEDIUM
jiantao88 android-mcp-server Command Execution index.js child_process.exec os command injection
33RISK
open ↗
Referência
CVE-2026-19960
CVE-2026-19960MEDIUM
Edimax EW-7478APC formWlbasic command injection
33RISK
open ↗
Referência
CVE-2026-19933
CVE-2026-19933MEDIUM
DefaultFuction Customer-Relationship-Management-In-C-Project Customer Search gets stack-based overflow
33RISK
open ↗
Referência
CVE-2026-14230
CVE-2026-14230MEDIUM
ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings
33RISK
open ↗
Referência
CVE-2026-19932
CVE-2026-19932MEDIUM
DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection
33RISK
open ↗
Referência
CVE-2026-14229
CVE-2026-14229MEDIUM
ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload
33RISK
open ↗
Referência
CVE-2016-4135
CVE-2016-4135—
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsof
28RISK
open ↗
Referência
CVE-2016-4228
CVE-2016-4228—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RISK
open ↗
Referência✓ VexDay Proof
FreeWPS 2.11 - 'images.php' Remote Code Execution
CVE-2006-1363—webappsphp
images.php in Justin White (aka YTZ) Free Web Publishing System (FreeWPS) 2.11 allows remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2026-19925
CVE-2026-19925MEDIUM
SourceCodester Stock Management System Master.php delete_supplier sql injection
33RISK
open ↗
Referência✓ VexDay Proof
XHP CMS 0.5 - 'upload' Remote Command Execution
CVE-2006-1371—webappsphp
Laurentiu Matei eXpandable Home Page (XHP) CMS 0.5 and earlier allows remote authenticated users to use the HTMLArea Fil
23RISK
open ↗
Referência✓ VexDay Proof
phpBB SpamBlocker Mod 1.0.2 - Remote File Inclusion
CVE-2006-5301—webappsphp
PHP remote file inclusion vulnerability in includes/antispam.php in the SpamBlockerMODv 1.0.2 and earlier module for php
23RISK
open ↗
Referência
CVE-2016-4313
CVE-2016-4313—
Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
Transmit.app 3.5.5 - 'ftps://' URL Handler Heap Buffer Overflow (PoC)
CVE-2007-0020—dososx
Heap-based buffer overflow in the SFTP protocol handler for Panic Transmit (Transmit.app) up to 3.5.5 allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
Yahoo! Music Jukebox 2.2 - 'AddImage()' ActiveX Remote Buffer Overflow (1)
CVE-2008-0623—remotewindows
Stack-based buffer overflow in the YMP Datagrid ActiveX control (datagrid.dll) in Yahoo! Music Jukebox 2.2.2.056 allows
23RISK
open ↗
Referência✓ VexDay Proof
Yahoo! Music Jukebox 2.2 - 'AddImage()' ActiveX Remote Buffer Overflow (2)
CVE-2008-0623—remotewindows
Stack-based buffer overflow in the YMP Datagrid ActiveX control (datagrid.dll) in Yahoo! Music Jukebox 2.2.2.056 allows
23RISK
open ↗
Referência
CVE-2016-4437
CVE-2016-4437CRITICALunder attack
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attack
100RISK
open ↗
Referência
CVE-2016-1525
CVE-2016-1525—
Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allow
60RISK
open ↗
Referência
CVE-2019-1619
CVE-2019-1619CRITICAL
Cisco Data Center Network Manager Authentication Bypass Vulnerability
85RISK
open ↗
Referência
CVE-2019-16117
CVE-2019-16117—
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admi
23RISK
open ↗
Referência
CVE-2026-93309
CVE-2026-93309MEDIUM
O-RAN-SC SMO OAM VES Collector allocation of resources
33RISK
open ↗
Referência
CVE-2026-63764
CVE-2026-63764HIGH
LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass
41RISK
open ↗
Referência
CVE-2019-16119
CVE-2019-16119—
SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/control
28RISK
open ↗
Referência
CVE-2019-1620
CVE-2019-1620CRITICAL
Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability
85RISK
open ↗
Referência
CVE-2014-10079
CVE-2014-10079—
In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hid
23RISK
open ↗
Referência
CVE-2026-93454
CVE-2026-93454MEDIUM
Aureus ERP through 1.6.0 Stored XSS via Payment Term Note
33RISK
open ↗
Referência✓ VexDay Proof
ig shop 1.0 - Code Execution / SQL Injection
CVE-2007-0134—webappsphp
Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the
28RISK
open ↗
Referência
CVE-2026-92920
CVE-2026-92920MEDIUM
admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled
33RISK
open ↗
← previouspage 577 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.