Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2026-9302
CVE-2026-9302MEDIUM
546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection
33RISK
open ↗
Referência
CVE-2026-9301
CVE-2026-9301MEDIUM
omec-project amf NGReset Message memory corruption
33RISK
open ↗
Referência
CVE-2026-9300
CVE-2026-9300MEDIUM
omec-project amf NGSetupRequest memory corruption
33RISK
open ↗
Referência✓ VexDay Proof
QuickTime Player 7.3.1.70 - 'RTSP' Remote Buffer Overflow
CVE-2008-0234—remotewindows
Buffer overflow in Apple Quicktime Player 7.3.1.70 and other versions before 7.4.1, when RTSP tunneling is enabled, allo
28RISK
open ↗
Referência
CVE-2026-58372
CVE-2026-58372HIGH
SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys
41RISK
open ↗
Referência
CVE-2010-2115
CVE-2010-2115—
SolarWinds TFTP Server 10.4.0.10 allows remote attackers to cause a denial of service (no new connections) via a crafted
50RISK
open ↗
Referência
CVE-2026-34100
CVE-2026-34100HIGH
Guardian Language-System SQL Injection via id Parameter in media.php
41RISK
open ↗
Referência
CVE-2026-14695
CVE-2026-14695MEDIUM
SourceCodester Multi-Vendor Online Grocery Management System Registration Users.php save_client sql injection
33RISK
open ↗
Referência
CVE-2026-14694
CVE-2026-14694MEDIUM
SourceCodester Multi-Vendor Online Grocery Management System POST Parameter Master.php cancel_order sql injection
33RISK
open ↗
Referência
CVE-2026-13572
CVE-2026-13572MEDIUM
itsourcecode Hospital Management System insertbillingrecord.php sql injection
33RISK
open ↗
Referência
CVE-2026-14606
CVE-2026-14606HIGH
RT-Thread SWM341 CAN SWM341.h CAN_Receive stack-based overflow
41RISK
open ↗
Referência
CVE-2026-14693
CVE-2026-14693MEDIUM
SourceCodester Multi-Vendor Online Grocery Management System Master.php cancel_order improper authorization
33RISK
open ↗
Referência
CVE-2010-2141
CVE-2010-2141—
SQL injection vulnerability in index.php in NITRO Web Gallery allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2026-34109
CVE-2026-34109CRITICAL
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech.php
48RISK
open ↗
Referência
CVE-2018-15884
CVE-2018-15884—
RICOH MP C4504ex devices allow HTML Injection via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.
23RISK
open ↗
Referência
CVE-2026-14761
CVE-2026-14761MEDIUM
radareorg radare2 str.c r_str_append integer overflow
33RISK
open ↗
Referência
CVE-2014-5112
CVE-2014-5112—
maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacha
23RISK
open ↗
Referência
CVE-2018-16133
CVE-2018-16133—
Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.
50RISK
open ↗
Referência
CVE-2026-13562
CVE-2026-13562HIGH
Edimax EW-7478APC POST Request formiNICSiteSurvey buffer overflow
41RISK
open ↗
Referência
CVE-2018-25328
CVE-2018-25328HIGH
VX Search 10.6.18 Local Buffer Overflow via Directory Field
41RISK
open ↗
Referência
CVE-2014-3220
CVE-2014-3220—
F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary u
28RISK
open ↗
Referência
CVE-2026-13548
CVE-2026-13548MEDIUM
itsourcecode Hospital Management System doctortimings.php sql injection
33RISK
open ↗
Referência
CVE-2014-3434
CVE-2014-3434—
Buffer overflow in the sysplant driver in Symantec Endpoint Protection (SEP) Client 11.x and 12.x before 12.1 RU4 MP1b,
23RISK
open ↗
Referência
CVE-2014-3544
CVE-2014-3544—
Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before
23RISK
open ↗
Referência
CVE-2014-5276
CVE-2014-5276—
Multiple cross-site scripting (XSS) vulnerabilities in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated u
23RISK
open ↗
Referência✓ VexDay Proof
Globsy 1.0 - 'file' Remote File Disclosure
CVE-2008-0905—webappsphp
Directory traversal vulnerability in globsy_edit.php in Globsy 1.0 allows remote attackers to read arbitrary files via a
23RISK
open ↗
Referência
CVE-2026-11581
CVE-2026-11581MEDIUM
Kali Forms < 2.4.13 - Contributor+ Stored XSS via Form Field Caption
33RISK
open ↗
Referência
CVE-2014-3631
CVE-2014-3631—
The assoc_array_gc function in the associative-array implementation in lib/assoc_array.c in the Linux kernel before 3.16
23RISK
open ↗
Referência
CVE-2016-7255
CVE-2016-7255HIGHunder attackransomware
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,
93RISK
open ↗
Referência
CVE-2018-11646
CVE-2018-11646—
webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFavicon
50RISK
open ↗
← previouspage 778 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.