Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,627cataloged exploits
40,914CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,390VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2023-7220
CVE-2023-7220CRITICAL
Totolink NR1800X cstecgi.cgi loginAuth stack-based overflow
48RISK
open ↗
Referência
CVE-2017-20275
CVE-2017-20275HIGH
Joomla! Component PHP-Bridge 1.2.3 SQL Injection via id Parameter
41RISK
open ↗
Referência
CVE-2017-20274
CVE-2017-20274HIGH
Joomla LMS King Professional 3.2.4.0 SQL Injection via learningpath
41RISK
open ↗
Referência
CVE-2016-20089
CVE-2016-20089HIGH
Iperius Remote 1.7.0 Unquoted Service Path Elevation of Privilege
41RISK
open ↗
Referência
CVE-2008-5323
CVE-2008-5323—
Cross-site scripting (XSS) vulnerability in index.php in Wysi Wiki Wyg 1.0 allows remote attackers to inject arbitrary w
23RISK
open ↗
Referência
CVE-2008-5944
CVE-2008-5944—
Cross-site scripting (XSS) vulnerability in modules.php in NavBoard 16 (2.6.0) allows remote attackers to inject arbitra
23RISK
open ↗
Referência
CVE-2016-20088
CVE-2016-20088HIGH
Comodo Chromodo Browser 52.15.25.664 Unquoted Service Path Privilege Escalation
41RISK
open ↗
Referência
CVE-2010-0376
CVE-2010-0376—
Cross-site scripting (XSS) vulnerability in product_list.php in JCE-Tech PHP Calendars, downloaded 2010-01-11, allows re
23RISK
open ↗
Referência
CVE-2026-90488
CVE-2026-90488MEDIUM
Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection
33RISK
open ↗
Referência
CVE-2024-25413
CVE-2024-25413CRITICAL
A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 all
48RISK
open ↗
Referência
CVE-2010-1361
CVE-2010-1361—
Cross-site scripting (XSS) vulnerability in shop/USER_ARTIKEL_HANDLING_AUFRUF.php in PHPepperShop 2.5 allows remote atta
23RISK
open ↗
Referência
CVE-2026-82693
CVE-2026-82693CRITICAL
Tenda AC1206 Web UI telnet TendaTelnet missing authentication
48RISK
open ↗
Referência
CVE-2026-82668
CVE-2026-82668MEDIUM
klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection
33RISK
open ↗
Referência
CVE-2009-2332
CVE-2009-2332—
CMS Chainuk 1.2 and earlier allows remote attackers to obtain sensitive information via (1) a crafted id parameter to in
23RISK
open ↗
Referência
CVE-2009-4359
CVE-2009-4359—
Cross-site scripting (XSS) vulnerability in folder.php in the SmartMedia 0.85 Beta module for XOOPS allows remote attack
23RISK
open ↗
Referência
CVE-2011-10013
CVE-2011-10013CRITICAL
Traq 2.0–2.3 admincp/common.php RCE
63RISK
open ↗
Referência
CVE-2011-10013
CVE-2011-10013CRITICAL
Traq 2.0–2.3 admincp/common.php RCE
63RISK
open ↗
Referência
CVE-2011-10013
CVE-2011-10013CRITICAL
Traq 2.0–2.3 admincp/common.php RCE
63RISK
open ↗
Referência
CVE-2013-7274
CVE-2013-7274—
Cross-site scripting (XSS) vulnerability in Wallpaper Script 3.5.0082 allows remote authenticated users to inject arbitr
23RISK
open ↗
Referência
CVE-2015-7707
CVE-2015-7707—
Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter
23RISK
open ↗
Referência
CVE-2017-17571
CVE-2017-17571—
FS Foodpanda Clone 1.0 has SQL Injection via the /food keywords parameter.
23RISK
open ↗
Referência
CVE-2026-82630
CVE-2026-82630MEDIUM
PowerJob Transport Endpoint TestController.java MuConnectionManager.getOrCreateConnection server-side request forgery
33RISK
open ↗
Referência
CVE-2017-17572
CVE-2017-17572—
FS Amazon Clone 1.0 has SQL Injection via the PATH_INFO to /VerAyari.
23RISK
open ↗
Referência
CVE-2026-32985
CVE-2026-32985CRITICAL
Xerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution
63RISK
open ↗
Referência
CVE-2022-25630
CVE-2022-25630MEDIUM
An authenticated user can embed malicious content with XSS into the admin group policy page.
33RISK
open ↗
Referência
CVE-2026-19454
CVE-2026-19454MEDIUM
JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download
33RISK
open ↗
Referência✓ VexDay Proof
Rankem - File Disclosure / Cross-Site Scripting / Cookie
CVE-2009-0248—webappsphp
Cross-site scripting (XSS) vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to inject arbitrar
23RISK
open ↗
Referência
CVE-2016-1525
CVE-2016-1525—
Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allow
60RISK
open ↗
Referência
CVE-2026-110069
CVE-2026-110069MEDIUM
Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions
33RISK
open ↗
Referência
CVE-2026-81835
CVE-2026-81835MEDIUM
RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection
33RISK
open ↗
← previouspage 762 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.