Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,328cataloged exploits
40,629CVEs with public exploitation
24,696lab-tested
AllReferência 26,377Exploit-DB 24,489GitHub PoC 18,128VulnCheck XDB 10,218Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-108901
CVE-2026-108901MEDIUM
Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer
33RISK
open ↗
Referência
CVE-2026-108897
CVE-2026-108897MEDIUM
Smart Media4U Technology SHAREit App WebView JS Bridge syncInvoke routine
33RISK
open ↗
Referência
CVE-2026-108895
CVE-2026-108895CRITICAL
Linksys E1700 setDMZ os command injection
48RISK
open ↗
Referência
CVE-2026-89297
CVE-2026-89297HIGH
Loja Automática <= 1.0.0 - Unauthenticated SQLi via 'id' Parameter
41RISK
open ↗
Referência
CVE-2026-14847
CVE-2026-14847MEDIUM
Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR
33RISK
open ↗
Referência
CVE-2026-108885
CVE-2026-108885MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/message/sysMessage/delete
33RISK
open ↗
Referência
CVE-2026-108884
CVE-2026-108884MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint
33RISK
open ↗
Referência
CVE-2026-14240
CVE-2026-14240MEDIUM
Tourmaster < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export
33RISK
open ↗
Referência
CVE-2026-16602
CVE-2026-16602HIGH
Content Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint
41RISK
open ↗
Referência
CVE-2026-16561
CVE-2026-16561HIGH
Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure
41RISK
open ↗
Referência
CVE-2026-94044
CVE-2026-94044MEDIUM
03-lovepreetSingh MCP route.ts create_file path traversal
33RISK
open ↗
Referência
CVE-2026-16572
CVE-2026-16572HIGH
LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie
41RISK
open ↗
Referência
CVE-2026-16565
CVE-2026-16565MEDIUM
Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API
33RISK
open ↗
Referência
CVE-2026-16564
CVE-2026-16564MEDIUM
Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint
33RISK
open ↗
Referência
CVE-2026-94015
CVE-2026-94015MEDIUM
SourceCodester Drug Recommendation System edit_user.php sql injection
33RISK
open ↗
Referência
CVE-2026-14554
CVE-2026-14554MEDIUM
Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters
48RISK
open ↗
Referência
CVE-2024-58387
CVE-2024-58387HIGH
Inspur HCM Cloud Arbitrary File Read via file/download Endpoint
41RISK
open ↗
Referência
CVE-2013-20008
CVE-2013-20008HIGH
Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password
41RISK
open ↗
Referência
CVE-2026-87777
CVE-2026-87777MEDIUM
Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute
33RISK
open ↗
Referência
CVE-2017-8678
CVE-2017-8678—
The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server
23RISK
open ↗
Referência
CVE-2026-96680
CVE-2026-96680MEDIUM
ByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization
33RISK
open ↗
Referência
CVE-2026-96676
CVE-2026-96676MEDIUM
Fast FAC1900R uhttpd get_alias_name stack-based overflow
33RISK
open ↗
Referência
CVE-2026-100192
CVE-2026-100192MEDIUM
X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint
33RISK
open ↗
Referência
CVE-2026-16542
CVE-2026-16542MEDIUM
Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar
33RISK
open ↗
Referência
CVE-2026-117526
CVE-2026-117526MEDIUM
reduxjs redux-devtools Remotedev Server evalAction code injection
33RISK
open ↗
Referência
CVE-2026-102846
CVE-2026-102846MEDIUM
gedelumbung HospitalManagement Configuration sistem.php simpan improper authorization
33RISK
open ↗
Referência
CVE-2026-117516
CVE-2026-117516MEDIUM
oretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection
33RISK
open ↗
Referência
CVE-2017-8680
CVE-2017-8680—
The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server
23RISK
open ↗
Referência
CVE-2026-93964
CVE-2026-93964MEDIUM
NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication
33RISK
open ↗
Referência
CVE-2026-19751
CVE-2026-19751MEDIUM
EnzoVezzaro mcp-dominican-layer parse-csv tool index.ts axios.get server-side request forgery
33RISK
open ↗
← previouspage 595 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.