Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
Wifi Soft Unibox Administration 3.0 & 3.1 - SQL Injection
CVE-2023-34635—webappsphp
Wifi Soft Unibox Administration 3.0 and 3.1 is vulnerable to SQL Injection. The vulnerability occurs because of not vali
23RISK
open ↗
Referência
CVE-2021-24286
CVE-2021-24286—
Redirect 404 to Parent < 1.3.1 - Reflected Cross-Site Scripting (XSS)
43RISK
open ↗
Referência✓ VexDay Proof
Kaqoo Auction - 'install_root' Multiple Remote File Inclusions
CVE-2007-1790—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Kaqoo Auction Software Free Edition allow remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
Picture-Engine 1.2.0 - 'wall.php?cat' SQL Injection
CVE-2007-1791—webappsphp
SQL injection vulnerability in wall.php in Picture-Engine 1.2.0 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2014-8826
CVE-2014-8826—
LaunchServices in Apple OS X before 10.10.2 does not properly handle file-type metadata, which allows attackers to bypas
23RISK
open ↗
Referência
CVE-2014-8904
CVE-2014-8904—
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
23RISK
open ↗
Referência
CVE-2026-67549
CVE-2026-67549HIGH
OpenImageIO: TIFF 1-bit CMYK bit conversion heap out-of-bounds write
41RISK
open ↗
Referência
CVE-2026-54460
CVE-2026-54460CRITICAL
OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover
48RISK
open ↗
Referência
CVE-2014-9178
CVE-2014-9178—
Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plu
23RISK
open ↗
Referência
CVE-2023-37269
CVE-2023-37269LOW
Winter CMS vulnerable to stored XSS through privileged upload of SVG file
28RISK
open ↗
Referência
CVE-2023-37979
CVE-2023-37979HIGH
WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS)
56RISK
open ↗
Referência✓ VexDay Proof
AirMore 1.6.1 - Denial of Service (PoC)
CVE-2019-9831—dosandroid
The AirMore application through 1.6.1 for Android allows remote attackers to cause a denial of service (system hang) via
28RISK
open ↗
Referência
CVE-2023-4278
CVE-2023-4278HIGH
MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation
41RISK
open ↗
Referência
CVE-2026-94042
CVE-2026-94042MEDIUM
AdithyaYelloju Restaurant Management System add_table.php mysqli_query sql injection
33RISK
open ↗
Referência
CVE-2026-94041
CVE-2026-94041MEDIUM
AdithyaYelloju Restaurant-Management-System add_menu.php sql injection
33RISK
open ↗
Referência
CVE-2026-94040
CVE-2026-94040MEDIUM
vas3k TaxHacker actions.ts testLLMProviderAction server-side request forgery
33RISK
open ↗
Referência
CVE-2026-94038
CVE-2026-94038MEDIUM
NonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery
33RISK
open ↗
Referência
CVE-2014-9567
CVE-2014-9567—
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows rem
50RISK
open ↗
Referência
CVE-2014-9567
CVE-2014-9567—
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows rem
50RISK
open ↗
Referência
CVE-2026-94033
CVE-2026-94033MEDIUM
SourceCodester Drug Recommendation System User Management add_user cross site scripting
33RISK
open ↗
Referência
CVE-2014-9583
CVE-2014-9583—
common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC
60RISK
open ↗
Referência
CVE-2014-9612
CVE-2014-9612—
SQL injection vulnerability in remotereporter/load_logfiles.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1
23RISK
open ↗
Referência
CVE-2026-94032
CVE-2026-94032MEDIUM
itsourcecode Leave Management System index.php sql injection
33RISK
open ↗
Referência
CVE-2026-85130
CVE-2026-85130HIGH
WPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent Logs
41RISK
open ↗
Referência
CVE-2026-92466
CVE-2026-92466HIGH
microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking
41RISK
open ↗
Referência
CVE-2026-85127
CVE-2026-85127HIGH
VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat Attachment
41RISK
open ↗
Referência
CVE-2026-85009
CVE-2026-85009MEDIUM
RestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment Recovery
33RISK
open ↗
Referência
CVE-2026-84829
CVE-2026-84829HIGH
Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter
41RISK
open ↗
Referência
CVE-2026-96882
CVE-2026-96882MEDIUM
TaleLin lin-cms-spring-boot book Endpoint BookController.java searchBook improper authorization
33RISK
open ↗
Referência
CVE-2026-92221
CVE-2026-92221MEDIUM
gedelumbung HospitalManagement app_global_admin_model.php generate_index_pasien sql injection
33RISK
open ↗
← previouspage 591 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.