Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2026-19782
CVE-2026-19782MEDIUM
WPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users
33RISK
open ↗
Referência
CVE-2026-15049
CVE-2026-15049HIGH
Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import
41RISK
open ↗
Referência
CVE-2013-2572
CVE-2013-2572—
A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 d
28RISK
open ↗
Referência
CVE-2013-2572
CVE-2013-2572—
A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 d
28RISK
open ↗
Referência
CVE-2026-76582
CVE-2026-76582MEDIUM
TRENDnet TEW-821DAP ssi ping.cgi system command injection
33RISK
open ↗
Referência✓ VexDay Proof
Gregarius 0.5.4 - SQL Injection
CVE-2008-3374—webappsphp
SQL injection vulnerability in ajax.php in Gregarius 0.5.4 and earlier allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2014-6332
CVE-2014-6332HIGHunder attack
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISK
open ↗
Referência
CVE-2012-4055
CVE-2012-4055—
SQL injection vulnerability in index2.php in Uiga Fan Club allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2017-0358
CVE-2017-0358HIGH
ntfs-3g: Modprobe influence vulnerability via environment variables
56RISK
open ↗
Referência
CVE-2018-9155
CVE-2018-9155—
Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary we
23RISK
open ↗
Referência
CVE-2018-9206
CVE-2018-9206—
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
60RISK
open ↗
Referência✓ VexDay Proof
Wsn (Multiple Products) - Local File Inclusion / Code Execution
CVE-2008-3555—webappsphp
Directory traversal vulnerability in index.php in (1) WSN Forum 4.1.43 and earlier, (2) Gallery 4.1.30 and earlier, (3)
23RISK
open ↗
Referência
CVE-2026-84021
CVE-2026-84021MEDIUM
Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL
33RISK
open ↗
Referência
CVE-2012-4252
CVE-2012-4252—
Multiple cross-site request forgery (CSRF) vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to hijack the au
23RISK
open ↗
Referência
CVE-2026-82846
CVE-2026-82846MEDIUM
Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields
33RISK
open ↗
Referência
CVE-2018-9445
CVE-2018-9445—
In readMetadata of Utils.cpp, there is a possible path traversal bug due to a confused deputy. This could lead to local
23RISK
open ↗
Referência✓ VexDay Proof
Vacation Rental Script 3.0 - 'id' SQL Injection
CVE-2008-3603—webappsphp
SQL injection vulnerability in index.php in Vacation Rental Script 3.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2026-81348
CVE-2026-81348LOW
My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and Sitemap
28RISK
open ↗
Referência
CVE-2026-18037
CVE-2026-18037MEDIUM
Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication
33RISK
open ↗
Referência
CVE-2011-1099
CVE-2011-1099—
Multiple directory traversal vulnerabilities in FocalMedia.Net Quick Polls before 1.0.2 allow remote attackers to (1) re
23RISK
open ↗
Referência
CVE-2013-3538
CVE-2013-3538—
Multiple cross-site scripting (XSS) vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to injec
23RISK
open ↗
Referência✓ VexDay Proof
Mihalism Multi Forum Host 3.0.x - Remote File Inclusion
CVE-2007-6657—webappsphp
PHP remote file inclusion vulnerability in source/includes/load_forum.php in Mihalism Multi Forum Host 3.0.x and earlier
23RISK
open ↗
Referência
CVE-2026-85637
CVE-2026-85637MEDIUM
jofpin trape Admin Endpoint sockets.py join_room missing authentication
33RISK
open ↗
Referência
CVE-2026-85703
CVE-2026-85703MEDIUM
ramon-victor freegpt-webui Jailbreak Mode backend.py getJailbreak allocation of resources
33RISK
open ↗
Referência
CVE-2026-16589
CVE-2026-16589HIGH
WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter
41RISK
open ↗
Referência
CVE-2026-16293
CVE-2026-16293MEDIUM
Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL
33RISK
open ↗
Referência
CVE-2026-85702
CVE-2026-85702MEDIUM
ramon-victor freegpt-webui Backend Conversation API backend.py _conversation missing authentication
33RISK
open ↗
Referência
CVE-2026-80116
CVE-2026-80116HIGH
PassMark PerformanceTest, BurnInTest, and OSForensics Privilege Escalation via DirectIo64.sys IOCTL
41RISK
open ↗
Referência✓ VexDay Proof
VideoLAN VLC Media Player 0.8.6i - '.tta' File Parsing Heap Overflow (PoC)
CVE-2008-3732—dosmultiple
Integer overflow in the Open function in modules/demux/tta.c in VLC Media Player 0.8.6i allows remote attackers to cause
28RISK
open ↗
Referência
Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE
CVE-2025-1097HIGHremotemultiple
ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation
68RISK
open ↗
← previouspage 781 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.