Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2026-4996
CVE-2026-4996MEDIUM
Sinaptik AI PandasAI pandasai-lancedb Extension lancedb.py get_relevant_docs_by_id sql injection
33RISK
open ↗
Referência
CVE-2026-4995
CVE-2026-4995MEDIUM
wandb OpenUI Window Message Event index.html cross site scripting
33RISK
open ↗
Referência
CVE-2026-4994
CVE-2026-4994MEDIUM
wandb OpenUI APIStatusError server.py generic_exception_handler information exposure
33RISK
open ↗
Referência
CVE-2026-4993
CVE-2026-4993MEDIUM
wandb OpenUI config.py hard-coded credentials
33RISK
open ↗
Referência
CVE-2025-15445
CVE-2025-15445MEDIUM
Restaurant Cafeteria <= 0.4.6 - Subscriber+ Arbitrary Plugin Installation/Activation
33RISK
open ↗
Referência
CVE-2026-9709
CVE-2026-9709HIGH
Themeco Cornerstone < 7.8.9 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Meta Disclosure
41RISK
open ↗
Referência
CVE-2026-78250
CVE-2026-78250MEDIUM
bytebot-ai bytebot Agent Execution Workflow infinite loop
33RISK
open ↗
Referência
CVE-2015-3000
CVE-2015-3000—
SysAid Help Desk before 15.2 allows remote attackers to cause a denial of service (CPU and memory consumption) via a lar
23RISK
open ↗
Referência✓ VexDay Proof
FaScript FaPhoto 1.0 - 'show.php' SQL Injection
CVE-2008-1714—webappsphp
SQL injection vulnerability in show.php in FaScript FaPhoto 1.0, when magic_quotes_gpc is disabled, allows remote attack
23RISK
open ↗
Referência
CVE-2012-1026
CVE-2012-1026—
Multiple SQL injection vulnerabilities in login2.php in XRay CMS 1.1.1 allow remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2018-19752
CVE-2018-19752—
DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.
38RISK
open ↗
Referência
CVE-2026-114400
CVE-2026-114400HIGH
Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
41RISK
open ↗
Referência
CVE-2026-114400
CVE-2026-114400HIGH
Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
41RISK
open ↗
Referência
CVE-2026-109926
CVE-2026-109926MEDIUM
Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation
33RISK
open ↗
Referência✓ VexDay Proof
Links Directory 1.1 - 'cat_id' SQL Injection
CVE-2008-1871—webappsphp
SQL injection vulnerability in links.php in Scriptsagent.com Links Directory 1.1 allows remote authenticated users to ex
23RISK
open ↗
Referência✓ VexDay Proof
5th Avenue Shopping Cart - 'category_id' SQL Injection
CVE-2008-1921—webappsphp
SQL injection vulnerability in store_pages/category_list.php in 5th Avenue Shopping Cart 1.2 trial edition allows remote
23RISK
open ↗
Referência✓ VexDay Proof
Zune Software - ActiveX Arbitrary File Overwrite
CVE-2008-1933—remotewindows
Absolute path traversal vulnerability in a certain ActiveX control in Zune allows user-assisted remote attackers to over
28RISK
open ↗
Referência
CVE-2012-5874
CVE-2012-5874—
Multiple SQL injection vulnerabilities in the (1) update_whosonline_reg and (2) update_whosonline_guest functions in Eli
23RISK
open ↗
Referência✓ VexDay Proof
Grape Statistics 0.2a - 'location' Remote File Inclusion
CVE-2008-1963—webappsphp
PHP remote file inclusion vulnerability in includes/functions.php in Quate Grape Web Statistics 0.2a allows remote attac
35RISK
open ↗
Referência
CVE-2017-0143
CVE-2017-0143HIGHunder attackransomware
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗
Referência✓ VexDay Proof
SubEdit Player build 4066 - subtitle Buffer Overflow (PoC)
CVE-2008-1973—doswindows
Heap-based buffer overflow in SubEdit Player build 4056 and 4066 allows remote attackers to cause a denial of service (c
23RISK
open ↗
Referência
CVE-2014-10020
CVE-2014-10020—
SQL injection vulnerability in login.php in Simple e-document 1.31 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência
CVE-2014-2533
CVE-2014-2533—
/sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arb
38RISK
open ↗
Referência
CVE-2017-0117
CVE-2017-0117—
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers
28RISK
open ↗
Referência
CVE-2023-25440
CVE-2023-25440MEDIUM
Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to exe
33RISK
open ↗
Referência
CVE-2023-27100
CVE-2023-27100CRITICAL
Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22
48RISK
open ↗
Referência
CVE-2012-1208
CVE-2012-1208—
Multiple cross-site scripting (XSS) vulnerabilities in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other
23RISK
open ↗
Referência
CVE-2012-4996
CVE-2012-4996—
Multiple SQL injection vulnerabilities in RivetTracker 1.03 and earlier allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2023-27350
CVE-2023-27350CRITICALunder attackransomware
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bui
100RISK
open ↗
Referência
CVE-2012-5894
CVE-2012-5894—
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitr
23RISK
open ↗
← previouspage 779 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.