Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-104118
CVE-2026-104118MEDIUM
Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR
33RISK
open ↗
Referência
CVE-2026-17005
CVE-2026-17005MEDIUM
Horizontal Scrolling Announcements <= 2.6 - Contributor+ Stored XSS via Style Field
33RISK
open ↗
Referência
CVE-2026-105134
CVE-2026-105134CRITICALunder attack
Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
100RISK
open ↗
Referência
CVE-2026-105133
CVE-2026-105133MEDIUMunder attack
Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
100RISK
open ↗
Referência✓ VexDay Proof
EB Design Pty Ltd - 'EBCRYPT.dll 2.0' Multiple Remote Vulnerabilities
CVE-2007-5110—remotewindows
Absolute path traversal vulnerability in the EbCrypt.eb_c_PRNGenerator.1 ActiveX control in EBCRYPT.DLL 2.0.0.2087 and e
23RISK
open ↗
Referência✓ VexDay Proof
EB Design Pty Ltd - 'EBCRYPT.dll 2.0' Multiple Remote Vulnerabilities
CVE-2007-5111—remotewindows
A certain ActiveX control in EBCRYPT.DLL 2.0 in EB Design ebCrypt allows remote attackers to cause a denial of service (
23RISK
open ↗
Referência
CVE-2016-2494
CVE-2016-2494—
Off-by-one error in sdcard/sdcard.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before
23RISK
open ↗
Referência✓ VexDay Proof
Adult Script 1.6 - Unauthorized Administrative Access
CVE-2007-6414—webappsphp
admin/administrator.php in Adult Script 1.6 and earlier sends a redirect to the web browser but does not exit, which all
23RISK
open ↗
Referência
CVE-2026-82610
CVE-2026-82610MEDIUM
itsourcecode Online Medicine Delivery System Login login.php employeeAuthentication sql injection
33RISK
open ↗
Referência
CVE-2026-77786
CVE-2026-77786MEDIUM
Rank Math SEO < 1.0.277 - Editor+ Core Settings Modification via fix-site-seo Ability
33RISK
open ↗
Referência
CVE-2026-112146
CVE-2026-112146MEDIUM
D-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentials
33RISK
open ↗
Referência
CVE-2016-4309
CVE-2016-4309—
Session fixation vulnerability in Symphony CMS 2.6.7, when session.use_only_cookies is disabled, allows remote attackers
28RISK
open ↗
Referência
CVE-2026-112281
CVE-2026-112281MEDIUM
libaribb24 through 1.0.3 Stack Buffer Overflow via decoder_handle_csi
33RISK
open ↗
Referência
CVE-2026-82801
CVE-2026-82801MEDIUM
NASA earthdata-search scale Endpoint handler.js scaleImage server-side request forgery
33RISK
open ↗
Referência
CVE-2026-82703
CVE-2026-82703MEDIUM
Edimax BR-6214K asp_setPing Endpoint ping.asp system os command injection
33RISK
open ↗
Referência
CVE-2026-80311
CVE-2026-80311MEDIUM
Stripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via IDOR
33RISK
open ↗
Referência
CVE-2026-112276
CVE-2026-112276MEDIUM
Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap
33RISK
open ↗
Referência
CVE-2026-101148
CVE-2026-101148CRITICAL
BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key
48RISK
open ↗
Referência
CVE-2026-77704
CVE-2026-77704LOW
Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval
28RISK
open ↗
Referência
CVE-2026-77012
CVE-2026-77012CRITICAL
Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password
48RISK
open ↗
Referência
CVE-2026-112271
CVE-2026-112271MEDIUM
libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser
33RISK
open ↗
Referência
CVE-2026-77010
CVE-2026-77010MEDIUM
HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Moderator Join URL Disclosure and Class Access Code Bypass
33RISK
open ↗
Referência✓ VexDay Proof
Anon Proxy Server 0.1000 - Remote Command Execution
CVE-2007-6459—webappsphp
Anon Proxy Server 0.100, and probably 0.101, allows remote attackers to execute arbitrary commands via shell metacharact
23RISK
open ↗
Referência✓ VexDay Proof
Form Tools 1.5.0b - Multiple Remote File Inclusions
CVE-2007-6464—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Form tools 1.5.0b allow remote attackers to execute arbitrary PHP
23RISK
open ↗
Referência
CVE-2026-112145
CVE-2026-112145MEDIUM
speaches-ai speaches Pyannote Diarization Model Loading pyannote_diarization.py PyannoteDiarizationModelManager._load_fn externally-controlled input to select classes or code
33RISK
open ↗
Referência
CVE-2026-101147
CVE-2026-101147HIGH
Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF
41RISK
open ↗
Referência
CVE-2026-103542
CVE-2026-103542MEDIUM
formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery
33RISK
open ↗
Referência
CVE-2026-103541
CVE-2026-103541MEDIUM
formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload
33RISK
open ↗
Referência
CVE-2016-4312
CVE-2016-4312—
XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH
23RISK
open ↗
Referência
CVE-2026-103540
CVE-2026-103540MEDIUM
formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine
33RISK
open ↗
← previouspage 578 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.