Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2012-2234
CVE-2012-2234—
Cross-site scripting (XSS) vulnerability in sources/users.queries.php in TeamPass before 2.1.6 allows remote authenticat
23RISK
open ↗
Referência
CVE-2022-21371
CVE-2022-21371HIGH
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported ve
78RISK
open ↗
Referência✓ VexDay Proof
BookmarkX script 2007 - 'topicid' SQL Injection
CVE-2008-0695—webappsphp
SQL injection vulnerability in index.php in BookmarkX script 2007 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência
CVE-2026-12206
CVE-2026-12206MEDIUM
Grit42 Grit data_table_entity.rb DataTableEntity sql injection
33RISK
open ↗
Referência
CVE-2026-7022
CVE-2026-7022MEDIUM
SmythOS sre HTTP Header AgentRuntime.class.ts AgentRuntime improper authentication
33RISK
open ↗
Referência
CVE-2026-12204
CVE-2026-12204MEDIUM
ShopXO Scheduled Task Endpoint Crontab.php GoodsGiveIntegral authorization
33RISK
open ↗
Referência
CVE-2026-7021
CVE-2026-7021MEDIUM
SmythOS sre Connector Service utils.ts information disclosure
33RISK
open ↗
Referência
CVE-2026-16296
CVE-2026-16296MEDIUM
Clearfy < 2.4.3 - Open Redirect via Cyrlitera 404 Handler
33RISK
open ↗
Referência
CVE-2018-18795
CVE-2018-18795—
School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter.
23RISK
open ↗
Referência
CVE-2026-6576
CVE-2026-6576MEDIUM
liangliangyy DjangoBlog WeChat Bot commonapi.py CommandHandler command injection
33RISK
open ↗
Referência
CVE-2026-6573
CVE-2026-6573MEDIUM
PHPEMS Instant Exam Creation exams.master.php temppage server-side request forgery
33RISK
open ↗
Referência
CVE-2026-6572
CVE-2026-6572MEDIUM
Collabora KodExplorer fileUpload Endpoint share.class.php improper authorization
33RISK
open ↗
Referência
CVE-2026-12198
CVE-2026-12198MEDIUM
Microweber API Endpoint thumbnail_img userfiles_path path traversal
33RISK
open ↗
Referência
CVE-2026-6571
CVE-2026-6571MEDIUM
kodcloud KodExplorer systemRole.class.php roleGroupAction authorization
33RISK
open ↗
Referência
CVE-2026-6579
CVE-2026-6579MEDIUM
liangliangyy DjangoBlog Clean Endpoint views.py missing authentication
33RISK
open ↗
Referência
CVE-2026-6578
CVE-2026-6578MEDIUM
liangliangyy DjangoBlog Setting settings.py hard-coded credentials
33RISK
open ↗
Referência
CVE-2026-6577
CVE-2026-6577MEDIUM
liangliangyy DjangoBlog logtracks Endpoint views.py missing authentication
33RISK
open ↗
Referência
CVE-2026-6570
CVE-2026-6570MEDIUM
kodcloud KodExplorer systemMember.class.php initInstall authorization
33RISK
open ↗
Referência
CVE-2026-6568
CVE-2026-6568MEDIUM
kodcloud KodExplorer Public Share share.class.php initShareOld path traversal
33RISK
open ↗
Referência
CVE-2026-6125
CVE-2026-6125MEDIUM
Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injection
33RISK
open ↗
Referência
CVE-2018-18795
CVE-2018-18795—
School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter.
23RISK
open ↗
Referência
CVE-2010-5062
CVE-2010-5062—
SQL injection vulnerability in search.php in MH Products kleinanzeigenmarkt allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Simple CMS 1.0.3 - 'area' SQL Injection
CVE-2008-0835—webappsphp
SQL injection vulnerability in indexen.php in Simple CMS 1.0.3 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2018-14912
CVE-2018-14912—
cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned
60RISK
open ↗
Referência
CVE-2011-1092
CVE-2011-1092—
Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial of servic
28RISK
open ↗
Referência
CVE-2018-18804
CVE-2018-18804—
Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb.
23RISK
open ↗
Referência
CVE-2026-11528
CVE-2026-11528HIGH
Tenda AC18 Web Management getRebootStatus sub_45304 stack-based overflow
41RISK
open ↗
Referência
CVE-2026-84934
CVE-2026-84934HIGH
JCH Optimize < 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task Override
41RISK
open ↗
Referência
CVE-2012-2576
CVE-2012-2576—
SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Prof
50RISK
open ↗
Referência
CVE-2026-7694
CVE-2026-7694MEDIUM
Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System elecMaxMinAvgValue sql injection
33RISK
open ↗
← previouspage 783 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.