Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
PyScript - Read Remote Python Source Code
CVE-2022-30286—remotepython
pyscriptjs (aka PyScript Demonstrator) in PyScript through 2022-05-04 allows a remote user to read Python source code.
28RISK
open ↗
Referência
CVE-2026-8935
CVE-2026-8935CRITICAL
Advanced Google Maps < 6.1.1 - Unauthenticated Administrator Account Creation
48RISK
open ↗
Referência
CVE-2026-8386
CVE-2026-8386MEDIUM
WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker ID
48RISK
open ↗
Referência
CVE-2026-25856
CVE-2026-25856HIGH
OpenBullet2 0.3.2 Authenticated RCE via Job Configuration Interface
56RISK
open ↗
Referência
CVE-2006-3995
CVE-2006-3995—
Multiple PHP remote file inclusion vulnerabilities in (1) uhp_config.php, and possibly (2) footer.php, (3) functions.php
28RISK
open ↗
Referência
CVE-2026-65010
CVE-2026-65010MEDIUM
Datasets Symlink-following Arbitrary File Write via Extractor.extract()
33RISK
open ↗
Referência
CVE-2026-12981
CVE-2026-12981HIGH
CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset
41RISK
open ↗
Referência
CVE-2026-63765
CVE-2026-63765HIGH
Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation
41RISK
open ↗
Referência
CVE-2026-64828
CVE-2026-64828MEDIUM
Froiden TableTrack 1.3.10 Stored XSS via Order Notes Field
33RISK
open ↗
Referência
CVE-2026-13690
CVE-2026-13690HIGH
UsersWP < 1.2.67 - Two-Factor Authentication Bypass
41RISK
open ↗
Referência
CVE-2026-12877
CVE-2026-12877CRITICAL
Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter
48RISK
open ↗
Referência
CVE-2026-13714
CVE-2026-13714CRITICAL
Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
48RISK
open ↗
Referência
CVE-2026-16490
CVE-2026-16490MEDIUM
itsourcecode Hospital Management System prescription.php sql injection
33RISK
open ↗
Referência
CVE-2022-35919
CVE-2022-35919HIGH
Authenticated requests for server update admin API allows path traversal in minio
53RISK
open ↗
Referência
CVE-2026-67611
CVE-2026-67611HIGH
OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
41RISK
open ↗
Referência
CVE-2018-17254
CVE-2018-17254—
The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.
60RISK
open ↗
Referência
CVE-2026-13390
CVE-2026-13390MEDIUM
The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation
33RISK
open ↗
Referência
CVE-2026-100887
CVE-2026-100887MEDIUM
amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_builder.php order_by sql injection
33RISK
open ↗
Referência✓ VexDay Proof
Mambo Component User Home Pages 0.5 - Remote File Inclusion
CVE-2006-3995—webappsphp
Multiple PHP remote file inclusion vulnerabilities in (1) uhp_config.php, and possibly (2) footer.php, (3) functions.php
28RISK
open ↗
Referência
CVE-2026-12690
CVE-2026-12690LOW
ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization
28RISK
open ↗
Referência
CVE-2026-13332
CVE-2026-13332CRITICAL
Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)
48RISK
open ↗
Referência
CVE-2026-13152
CVE-2026-13152HIGH
Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation
41RISK
open ↗
Referência
CVE-2026-12493
CVE-2026-12493HIGH
Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order
41RISK
open ↗
Referência
CVE-2020-3452
CVE-2020-3452HIGHunder attack
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability
100RISK
open ↗
Referência
CVE-2026-97884
CVE-2026-97884MEDIUM
mathurvishal CloudClassroom-PHP-Project Student Update Functionality updatestudent.php sql injection
33RISK
open ↗
Referência
CVE-2026-96777
CVE-2026-96777MEDIUM
Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injection
33RISK
open ↗
Referência
CVE-2026-84743
CVE-2026-84743LOW
The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes
28RISK
open ↗
Referência
CVE-2026-92420
CVE-2026-92420LOW
Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR
28RISK
open ↗
Referência
CVE-2022-50966
CVE-2022-50966MEDIUM
uBidAuction 2.0.1 news manage Reflected XSS
33RISK
open ↗
Referência✓ VexDay Proof
TinyPHP Forum 3.6 - 'profile.php' Remote Code Execution
CVE-2006-7063—webappsphp
Directory traversal vulnerability in profile.php in TinyPHPforum 3.6 and earlier allows remote attackers to include and
23RISK
open ↗
← previouspage 623 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.