Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2018-20220
CVE-2018-20220—
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authen
28RISK
open ↗
Referência
CVE-2026-82125
CVE-2026-82125MEDIUM
Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOR
33RISK
open ↗
Referência
CVE-2018-20556
CVE-2018-20556—
SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary
28RISK
open ↗
Referência
CVE-2018-18858
CVE-2018-18858—
Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS.
23RISK
open ↗
Referência
CVE-2026-82124
CVE-2026-82124MEDIUM
Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output
33RISK
open ↗
Referência
CVE-2026-78474
CVE-2026-78474MEDIUM
Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated Order and Customer Data Disclosure via 'btn_print' Parameter
33RISK
open ↗
Referência
CVE-2024-58385
CVE-2024-58385CRITICAL
Yonyou U8 CRM SQL Injection via fillbacksettingedit.php
48RISK
open ↗
Referência
CVE-2023-54398
CVE-2023-54398CRITICAL
Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet
48RISK
open ↗
Referência
CVE-2023-54398
CVE-2023-54398CRITICAL
Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet
48RISK
open ↗
Referência✓ VexDay Proof
Crafty Syntax Image Gallery 3.1g - Remote Code Execution
CVE-2006-1667—webappsphp
SQL injection vulnerability in slides.php in Eric Gerdes Crafty Syntax Image Gallery (CSIG) (aka PHP thumbnail Photo Gal
23RISK
open ↗
Referência
CVE-2026-77702
CVE-2026-77702MEDIUM
Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token
33RISK
open ↗
Referência
CVE-2026-76559
CVE-2026-76559MEDIUM
WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL Handling
33RISK
open ↗
Referência✓ VexDay Proof
PHP Simple Shop 2.0 - 'abs_path' Remote File Inclusion
CVE-2006-4052—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools PHP Simple Shop 2.0 and earlier allow remote att
28RISK
open ↗
Referência✓ VexDay Proof
PHPSherpa - '/include/config.inc.php' Remote File Inclusion
CVE-2007-0495—webappsphp
PHP remote file inclusion vulnerability in include/config.inc.php in PhpSherpa allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
PhotoFiltre Studio 8.1.1 - '.tif' Local Buffer Overflow
CVE-2007-2192—localwindows
Buffer overflow in Photofiltre Studio 8.1.1 allows user-assisted remote attackers to execute arbitrary code via a crafte
23RISK
open ↗
Referência
CVE-2016-1106
CVE-2016-1106—
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsof
35RISK
open ↗
Referência
CVE-2016-1524
CVE-2016-1524—
Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote
60RISK
open ↗
Referência
CVE-2016-1525
CVE-2016-1525—
Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allow
60RISK
open ↗
Referência
CVE-2018-7315
CVE-2018-7315—
SQL Injection exists in the Ek Rishta 2.9 component for Joomla! via the gender, age1, age2, religion, mothertounge, cast
23RISK
open ↗
Referência
CVE-2021-46417
CVE-2021-46417—
Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privilege
50RISK
open ↗
Referência
CVE-2026-19764
CVE-2026-19764MEDIUM
Raisecom Communication Command and Dispatch Management Platform getpwd.php sql injection
33RISK
open ↗
Referência
CVE-2026-15384
CVE-2026-15384MEDIUM
Manual Image Crop < 1.15 - Subscriber+ Arbitrary Attachment Image Overwrite via IDOR
33RISK
open ↗
Referência
CVE-2018-0838
CVE-2018-0838—
Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remot
35RISK
open ↗
Referência
Microsoft Windows 11 - Kernel Privilege Escalation
CVE-2024-21338HIGHunder attackransomwarelocalwindows
Windows Kernel Elevation of Privilege Vulnerability
83RISK
open ↗
Referência
CVE-2026-75081
CVE-2026-75081MEDIUM
Webkul Bagisto store behavioral workflow
33RISK
open ↗
Referência
CVE-2026-19994
CVE-2026-19994MEDIUM
Webkul Bagisto Configuration Management execute authorization
33RISK
open ↗
Referência
CVE-2026-14832
CVE-2026-14832MEDIUM
ShopSmart Loyalty for WooCommerce <= 1.0.0 - Unauthenticated Sensitive Information Disclosure via shopsmart_check_phone
33RISK
open ↗
Referência✓ VexDay Proof
Wheatblog 1.1 - 'session.php' Remote File Inclusion
CVE-2006-4198—webappsphp
PHP remote file inclusion vulnerability in includes/session.php in Wheatblog (wB) 1.1 and earlier, when register_globals
23RISK
open ↗
Referência✓ VexDay Proof
WebSPELL 4.01.02 - 'picture.php' File Disclosure
CVE-2007-2368—webappsphp
picture.php in WebSPELL 4.01.02 and earlier allows remote attackers to read arbitrary files via the file parameter.
23RISK
open ↗
Referência
CVE-2016-3223
CVE-2016-3223—
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold an
28RISK
open ↗
← previouspage 585 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.