Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-15377
Eleveo Call Recording Software sendlogfile improper authorization
33RISK
open ↗Referência
CVE-2020-5902
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic
100RISK
open ↗Referência
CVE-2026-15375
Eleveo Call Recording Software LDAP User users_ldap.jsp improper authorization
33RISK
open ↗Referência
CVE-2020-9374
On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command execution vulnerability in the diagnostics area can be exploit
35RISK
open ↗Referência✓ VexDay Proof
TaskTracker 1.5 - 'Customize.asp' Remote Add Administrator
Geckovich TaskTracker Pro 1.5 and earlier allows remote attackers to add administrative or other accounts via an Add act
23RISK
open ↗Referência
CVE-2026-108963
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a data
41RISK
open ↗Referência
CVE-2026-108768
zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources
33RISK
open ↗Referência✓ VexDay Proof
AutoDealer 2.0 - 'detail.asp?iPro' SQL Injection
SQL injection vulnerability in detail.asp in ASP SiteWare autoDealer 2.0 and earlier allows remote attackers to execute
23RISK
open ↗Referência
CVE-2013-6232
Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web
23RISK
open ↗Referência
CVE-2026-109175
MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList
33RISK
open ↗Referência
CVE-2026-109165
TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create
33RISK
open ↗Referência
CVE-2026-108827
Zen Cart Administrative Module Management general.php zen_call_function code injection
28RISK
open ↗Referência
CVE-2026-108878
JeecgBoot through 3.9.5 Missing Authorization via /airag/app/queryById
33RISK
open ↗Referência
CVE-2019-6272
Command injection vulnerability in login_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attacker
28RISK
open ↗Referência
CVE-2026-94295
Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature
33RISK
open ↗Referência
CVE-2026-76556
WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter Rules
33RISK
open ↗Referência
CVE-2026-80072
User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters
33RISK
open ↗Referência
CVE-2026-86780
Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text
33RISK
open ↗Referência
CVE-2026-78151
FormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response
33RISK
open ↗Referência
CVE-2026-77788
Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas
33RISK
open ↗Referência
CVE-2026-82631
valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.