Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,950cataloged exploits
40,798CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,343VulnCheck XDB 10,507Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,377 exploits
Referência
CVE-2017-17626
Readymade PHP Classified Script 3.3 has SQL Injection via the /categories subctid or mctid parameter.
23RISK
open ↗Referência
CVE-2026-88802
MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion
41RISK
open ↗Referência
CVE-2026-86510
D-Link DIR-822A L2TP Control Message tunnel_set_params out-of-bounds write
48RISK
open ↗Referência
CVE-2026-97885
mathurvishal CloudClassroom-PHP-Project updatefaculty.php sql injection
33RISK
open ↗Referência
CVE-2026-94039
vas3k TaxHacker Invoice PDF Renderer actions.ts generateInvoicePDF server-side request forgery
33RISK
open ↗Referência
CVE-2017-17626
Readymade PHP Classified Script 3.3 has SQL Injection via the /categories subctid or mctid parameter.
23RISK
open ↗Referência
CVE-2017-17628
Responsive Realestate Script 3.2 has SQL Injection via the property-list tbud parameter.
23RISK
open ↗Referência
CVE-2026-92459
yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint
41RISK
open ↗Referência
CVE-2026-86475
Appointment Hour Booking < 1.5.95 - Unauthenticated Booking Capacity Bypass via Multi-Appointment Submission
33RISK
open ↗Referência
CVE-2026-91995
pig before 4.1.0 Unverified Password Change via /register/password
48RISK
open ↗Referência
CVE-2026-90521
jaychouchannel Tourism-Management-System CRUD MenpiaodingdanController.java authorization
33RISK
open ↗Referência
CVE-2026-90515
SourceCodester School Registration and Fee System delete_stud.php sql injection
33RISK
open ↗Referência
CVE-2026-91779
GNU Binutils Eh Frame elf-eh-frame.c _bfd_elf_eh_frame_section_offset null pointer dereference
33RISK
open ↗Referência
CVE-2026-86509
D-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow
48RISK
open ↗Referência
CVE-2026-90520
jaychouchannel Tourism-Management-System Authorization Interceptor AuthorizationInterceptor.java improper authorization
33RISK
open ↗Referência
CVE-2026-90517
PHPGurukul Bank Locker Management System view-assign-locker.php authorization
33RISK
open ↗Referência
CVE-2026-89009
WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server
41RISK
open ↗Referência
CVE-2026-86813
MetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-To
33RISK
open ↗Referência
CVE-2026-90516
SourceCodester School Registration and Fee System pay_report.php sql injection
33RISK
open ↗Referência
CVE-2026-86809
Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass
33RISK
open ↗Referência
CVE-2026-82213
Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR
33RISK
open ↗Referência
CVE-2017-17637
Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.
23RISK
open ↗Referência
CVE-2026-86812
WPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure and Modification via food-orders REST API
33RISK
open ↗Referência
CVE-2026-86782
Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR
33RISK
open ↗Referência
CVE-2026-86789
Connections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure via cn-api/v1 REST Routes
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.