Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,640cataloged exploits
40,919CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,403VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência✓ VexDay Proof
Joomla! Component DT Register - SQL Injection
SQL injection vulnerability in the DT Register (com_dtregister) 2.2.3 component for Joomla! allows remote attackers to e
23RISK
open ↗Referência
CVE-2026-6188
SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
33RISK
open ↗Referência
CVE-2026-6187
SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
33RISK
open ↗Referência
CVE-2018-8880
Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before showing th
28RISK
open ↗Referência
CVE-2026-6195
Totolink A7100RU CGI cstecgi.cgi setPasswordCfg os command injection
53RISK
open ↗Referência
CVE-2026-6194
Totolink A3002MU HTTP Request formWlanSetup sub_410188 stack-based overflow
41RISK
open ↗Referência
CVE-2026-6193
PHPGurukul Daily Expense Tracking System register.php sql injection
33RISK
open ↗Referência
CVE-2026-6192
uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflow
33RISK
open ↗Referência
CVE-2018-25232
Softros LAN Messenger 9.2 Denial of Service via Log Files Location
33RISK
open ↗Referência
CVE-2014-6287
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗Referência
CVE-2012-3577
Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress
28RISK
open ↗Referência✓ VexDay Proof
Exponent CMS 0.96.3 - 'view' Remote Command Execution
Directory traversal vulnerability in index.php in Exponent CMS 0.96.3 allows remote attackers to read and execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke Module books SQL - 'cid' SQL Injection
SQL injection vulnerability in the Books module of PHP-Nuke allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Referência
CVE-2026-93959
SourceCodester Online Reviewer Management System btn_functions.php sql injection
33RISK
open ↗Referência
CVE-2026-92425
Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR
33RISK
open ↗Referência
CVE-2026-94037
00Kisumi00 mcp-file-analyzer analyze_csv_data MCP tool main.py ControlFlowNode path traversal
33RISK
open ↗Referência
CVE-2013-2619
Directory traversal vulnerability in Aspen before 0.22 allows remote attackers to read arbitrary files via a .. (dot dot
23RISK
open ↗Referência
CVE-2026-14844
Master Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes
33RISK
open ↗Referência✓ VexDay Proof
SunLight CMS 5.3 - 'root' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in SunLight CMS 5.3 allow remote attackers to execute arbitrary PHP c
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.