Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,063cataloged exploits
40,808CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,506 exploits
Referência
CVE-2026-14694
CVE-2026-14694MEDIUM
SourceCodester Multi-Vendor Online Grocery Management System POST Parameter Master.php cancel_order sql injection
33RISK
open ↗
Referência
CVE-2026-13572
CVE-2026-13572MEDIUM
itsourcecode Hospital Management System insertbillingrecord.php sql injection
33RISK
open ↗
Referência
CVE-2026-14606
CVE-2026-14606HIGH
RT-Thread SWM341 CAN SWM341.h CAN_Receive stack-based overflow
41RISK
open ↗
Referência
CVE-2026-14693
CVE-2026-14693MEDIUM
SourceCodester Multi-Vendor Online Grocery Management System Master.php cancel_order improper authorization
33RISK
open ↗
Referência
CVE-2010-2141
CVE-2010-2141—
SQL injection vulnerability in index.php in NITRO Web Gallery allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2010-2676
CVE-2010-2676—
Multiple directory traversal vulnerabilities in index.php in Open Web Analytics (OWA) 1.2.3 might allow remote attackers
23RISK
open ↗
Referência
CVE-2026-11482
CVE-2026-11482MEDIUM
SourceCodester Class and Exam Timetabling System archive5.php sql injection
33RISK
open ↗
Referência
CVE-2026-58051
CVE-2026-58051HIGH
libssh2 - Free of Uninitialized Pointer in publickey List Cleanup
41RISK
open ↗
Referência
CVE-2026-11481
CVE-2026-11481LOW
yoanbernabeu grepai Postgres Embedding Cache chunker.go PostgresStore.LookupByContentHash weak hash
28RISK
open ↗
Referência
CVE-2026-13491
CVE-2026-13491MEDIUM
78 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service
33RISK
open ↗
Referência✓ VexDay Proof
Apple Mac OSX 10.5.0 (Leopard) - vpnd Remote Denial of Service (PoC)
CVE-2007-6276—dososx
The accept_connections function in the virtual private network daemon (vpnd) in Apple Mac OS X 10.5 before 10.5.4 allows
23RISK
open ↗
Referência
CVE-2021-47968
CVE-2021-47968MEDIUM
Podcast Generator 3.1 Persistent Cross-Site Scripting via long_description
33RISK
open ↗
Referência
CVE-2021-47967
CVE-2021-47967MEDIUM
PHP Timeclock 1.04 Multiple Cross-Site Scripting via Parameters
33RISK
open ↗
Referência
CVE-2021-47966
CVE-2021-47966HIGH
PHP Timeclock 1.04 SQL Injection via login.php
41RISK
open ↗
Referência
CVE-2016-7288
CVE-2016-7288—
The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m
45RISK
open ↗
Referência✓ VexDay Proof
OpenSiteAdmin 0.9.1.1 - Multiple File Inclusions
CVE-2008-0648—webappsphp
Multiple PHP remote file inclusion vulnerabilities in OpenSiteAdmin 0.9.1.1 and earlier allow remote attackers to execut
23RISK
open ↗
Referência
CVE-2011-5200
CVE-2011-5200—
Multiple SQL injection vulnerabilities in DeDeCMS, possibly 5.6, allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência
CVE-2016-6515
CVE-2016-6515—
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
35RISK
open ↗
Referência
CVE-2016-6598
CVE-2016-6598—
BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service (FileStorageService) on
28RISK
open ↗
Referência
CVE-2026-6073
CVE-2026-6073HIGH
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
41RISK
open ↗
Referência
CVE-2012-1933
CVE-2012-1933—
Multiple PHP remote file inclusion vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4 before RC4, when register_global
23RISK
open ↗
Referência
CVE-2018-17375
CVE-2018-17375—
SQL Injection exists in the Music Collection 3.0.3 component for Joomla! via the id parameter.
23RISK
open ↗
Referência
CVE-2011-5278
CVE-2011-5278—
SQL injection vulnerability in signature.php in Advanced Forum Signatures plugin (aka afsignatures) 2.0.4 for MyBB allow
23RISK
open ↗
Referência
CVE-2016-6601
CVE-2016-6601—
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows rem
60RISK
open ↗
Referência
CVE-2014-5445
CVE-2014-5445—
Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 a
60RISK
open ↗
Referência
CVE-2021-47973
CVE-2021-47973HIGH
Sticky Notes Widget 3.0.6 Denial of Service via Buffer Overflow
41RISK
open ↗
Referência
CVE-2014-5460
CVE-2014-5460—
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remot
60RISK
open ↗
Referência
CVE-2018-17375
CVE-2018-17375—
SQL Injection exists in the Music Collection 3.0.3 component for Joomla! via the id parameter.
23RISK
open ↗
Referência
CVE-2026-6335
CVE-2026-6335MEDIUM
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
33RISK
open ↗
Referência
CVE-2010-3467
CVE-2010-3467—
SQL injection vulnerability in modules/sections/index.php in E-Xoopport Samsara 3.1 and earlier, when the Tutorial modul
23RISK
open ↗
← previouspage 754 / 884next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.