Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,331cataloged exploits
40,631CVEs with public exploitation
24,696lab-tested
AllReferência 26,377Exploit-DB 24,489GitHub PoC 18,131VulnCheck XDB 10,218Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-114260
CVE-2026-114260MEDIUM
oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication
33RISK
open ↗
Referência
CVE-2026-114259
CVE-2026-114259MEDIUM
oretnom23 file-management-system-php admin_class.php save_files unrestricted upload
33RISK
open ↗
Referência
CVE-2026-114258
CVE-2026-114258MEDIUM
oretnom23 file-management-system-php File Management files.php sql injection
33RISK
open ↗
Referência
CVE-2026-114257
CVE-2026-114257MEDIUM
oretnom23 file-management-system-php File Download download.php readfile sql injection
33RISK
open ↗
Referência
CVE-2026-81740
CVE-2026-81740MEDIUM
Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback
33RISK
open ↗
Referência
CVE-2026-104120
CVE-2026-104120MEDIUM
modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery
33RISK
open ↗
Referência
CVE-2026-104054
CVE-2026-104054MEDIUM
calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization
33RISK
open ↗
Referência
CVE-2026-104053
CVE-2026-104053MEDIUM
itsourcecode Pet Shop Management System admin_reservefilter.php sql injection
33RISK
open ↗
Referência
CVE-2026-103544
CVE-2026-103544MEDIUM
datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong session
33RISK
open ↗
Referência
CVE-2026-96255
CVE-2026-96255HIGH
Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug Log
41RISK
open ↗
Referência
CVE-2026-81809
CVE-2026-81809HIGH
Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback
41RISK
open ↗
Referência
CVE-2026-81739
CVE-2026-81739HIGH
Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback
41RISK
open ↗
Referência
CVE-2026-85573
CVE-2026-85573HIGH
All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload
41RISK
open ↗
Referência
CVE-2026-85415
CVE-2026-85415MEDIUM
Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL
33RISK
open ↗
Referência
CVE-2026-85001
CVE-2026-85001MEDIUM
EmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribute
33RISK
open ↗
Referência
CVE-2026-83560
CVE-2026-83560MEDIUM
New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass
33RISK
open ↗
Referência
CVE-2026-82127
CVE-2026-82127LOW
Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields
28RISK
open ↗
Referência
CVE-2026-105471
CVE-2026-105471MEDIUM
girishsaraf Online-Appointment-Booking-System Registration signup.php sql injection
33RISK
open ↗
Referência
CVE-2026-97332
CVE-2026-97332MEDIUM
User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)
33RISK
open ↗
Referência
CVE-2026-93549
CVE-2026-93549HIGH
CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass
41RISK
open ↗
Referência
CVE-2026-80333
CVE-2026-80333MEDIUM
Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes
33RISK
open ↗
Referência
CVE-2026-105099
CVE-2026-105099MEDIUM
Omega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting
33RISK
open ↗
Referência
CVE-2026-105098
CVE-2026-105098MEDIUM
Omega Solution CoinEx Crypto Support Ticket API customer information disclosure
33RISK
open ↗
Referência
CVE-2026-104052
CVE-2026-104052MEDIUM
itsourcecode Pet Shop Management System admin_reject_completed.php sql injection
33RISK
open ↗
Referência
CVE-2026-90706
CVE-2026-90706MEDIUM
D-Link DWR-M921 formWsc os command injection
33RISK
open ↗
Referência
CVE-2026-90705
CVE-2026-90705MEDIUM
D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection
33RISK
open ↗
Referência
CVE-2026-90607
CVE-2026-90607CRITICAL
Totolink A3002MU boa formNewSchedule buffer overflow
48RISK
open ↗
Referência
CVE-2026-92399
CVE-2026-92399MEDIUM
GPAC WebSocket rmt_ws.c rmt_client_handle_ws_frame heap-based overflow
33RISK
open ↗
Referência
CVE-2026-92364
CVE-2026-92364MEDIUM
itsourcecode Leave Management System index.php sql injection
33RISK
open ↗
Referência
CVE-2025-68624
CVE-2025-68624MEDIUM
N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user
33RISK
open ↗
← previouspage 609 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.