Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-108932
CVE-2026-108932MEDIUM
Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting
33RISK
open ↗
Referência
CVE-2026-109571
CVE-2026-109571LOW
Fire-Boltt BSW013 firmware through V0.0.8 Unauthenticated Heart Rate Disclosure via BLE
28RISK
open ↗
Referência
CVE-2026-109570
CVE-2026-109570MEDIUM
Fire-Boltt BSW013 through V0.0.8 Unauthenticated BLE Notification Injection
33RISK
open ↗
Referência
CVE-2026-108930
CVE-2026-108930MEDIUM
Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosure
33RISK
open ↗
Referência
CVE-2026-108928
CVE-2026-108928MEDIUM
itsourcecode Online Admission System sum.php sql injection
33RISK
open ↗
Referência
CVE-2026-108927
CVE-2026-108927MEDIUM
itsourcecode Baptism Information Management System pbaptism.php sql injection
33RISK
open ↗
Referência
CVE-2026-109425
CVE-2026-109425MEDIUM
Tink-go 2.8.0 Keyset Validation Bypass via NewHandleWithNoSecrets
33RISK
open ↗
Referência
CVE-2026-108926
CVE-2026-108926MEDIUM
itsourcecode Baptism Information Management System ebaptism.php sql injection
33RISK
open ↗
Referência
CVE-2017-6327
CVE-2017-6327HIGHunder attack
The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situ
83RISK
open ↗
Referência
CVE-2026-85091
CVE-2026-85091HIGH
zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate
41RISK
open ↗
Referência
CVE-2026-94003
CVE-2026-94003CRITICAL
Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow
48RISK
open ↗
Referência
CVE-2026-104084
CVE-2026-104084HIGH
SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token
41RISK
open ↗
Referência
CVE-2026-93997
CVE-2026-93997MEDIUM
SourceCodester Drug Recommendation System edit_symptom.php sql injection
33RISK
open ↗
Referência
CVE-2017-7642
CVE-2017-7642—
The sudo helper in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.21 allows local use
23RISK
open ↗
Referência
CVE-2017-7643
CVE-2017-7643—
Proxifier for Mac before 2.19 allows local users to gain privileges via the first parameter to the KLoader setuid progra
23RISK
open ↗
Referência
CVE-2026-108158
CVE-2026-108158HIGH
plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert
41RISK
open ↗
Referência
CVE-2026-104083
CVE-2026-104083MEDIUM
SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content
33RISK
open ↗
Referência
CVE-2026-104077
CVE-2026-104077HIGH
Obsidian Desktop < 1.14.0 RCE via Slides Plugin Markdown
41RISK
open ↗
Referência
CVE-2026-93976
CVE-2026-93976MEDIUM
code-projects Assessment Management add-user.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-104078
CVE-2026-104078HIGH
Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass
41RISK
open ↗
Referência
CVE-2026-93972
CVE-2026-93972MEDIUM
SourceCodester Online Reviewer Management System btn_functions.php sql injection
33RISK
open ↗
Referência
CVE-2026-81653
CVE-2026-81653MEDIUM
NextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR
33RISK
open ↗
Referência
CVE-2017-8870
CVE-2017-8870—
Buffer overflow in AudioCoder 0.8.46 allows remote attackers to execute arbitrary code via a crafted .m3u file.
43RISK
open ↗
Referência✓ VexDay Proof
Mambo Component MiniBB 1.5a - Remote File Inclusion
CVE-2006-3690—webappsphp
Multiple PHP remote file inclusion vulnerabilities in MiniBB Forum 1.5a and earlier allow remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component com_videodb 0.3en - Remote File Inclusion
CVE-2006-3736—webappsphp
PHP remote file inclusion vulnerability in core/videodb.class.xml.php in the VideoDB component for Mambo 0.3 and earlier
23RISK
open ↗
Referência✓ VexDay Proof
CLUB-Nuke [XP] 2.0 LCID 2048 (Turkish Version) - SQL Injection
CVE-2006-4072—webappsasp
Multiple SQL injection vulnerabilities in Club-Nuke [XP] 2.0 LCID 2048 allow remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
VWar 1.50 R14 - 'online.php' SQL Injection
CVE-2006-4142—webappsphp
SQL injection vulnerability in extra/online.php in Virtual War (VWar) 1.5.0 R14 and earlier allows remote attackers to e
23RISK
open ↗
Referência✓ VexDay Proof
TinyWebGallery 1.5 - 'image' Remote File Inclusion
CVE-2006-4166—webappsphp
PHP remote file inclusion vulnerability in TinyWebGallery 1.5 and earlier allows remote attackers to execute arbitrary P
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component Peoplebook 1.0 - Remote File Inclusion
CVE-2006-4195—webappsphp
PHP remote file inclusion vulnerability in param.peoplebook.php in the Peoplebook Component for Mambo (com_peoplebook) 1
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component Security Images 3.0.5 - Remote File Inclusion
CVE-2006-5048—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Security Images (com_securityimages) component 3.0.5 and earlier f
28RISK
open ↗
← previouspage 622 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.