Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2026-17022
CVE-2026-17022HIGH
Salon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard
41RISK
open ↗
Referência
CVE-2013-1493
CVE-2013-1493—
The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and
60RISK
open ↗
Referência✓ VexDay Proof
CustomCMS 4.0 - 'print.php' SQL Injection
CVE-2008-4156—webappsphp
SQL injection vulnerability in print.php in CustomCms (CCMS) Gaming Portal 4.0, when magic_quotes_gpc is disabled, allow
23RISK
open ↗
Referência
CVE-2026-11580
CVE-2026-11580MEDIUM
Kali Forms < 2.4.17 - Contributor+ Arbitrary Post Metadata Disclosure via IDOR
33RISK
open ↗
Referência
CVE-2026-41465
CVE-2026-41465HIGH
ProjeQtor < 12.4.4 Path Traversal via dynamicDialog.php
41RISK
open ↗
Referência
CVE-2026-15205
CVE-2026-15205HIGH
Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup
41RISK
open ↗
Referência
CVE-2011-1715
CVE-2011-1715—
Directory traversal vulnerability in framework/source/resource/qx/test/part/delay.php in QooxDoo 1.3 and possibly other
23RISK
open ↗
Referência
CVE-2026-18035
CVE-2026-18035MEDIUM
User Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API
33RISK
open ↗
Referência✓ VexDay Proof
Alt-N SecurityGateway 1.00-1.01 - Remote Stack Overflow
CVE-2008-4193—remotewindows
Stack-based buffer overflow in SecurityGateway.dll in Alt-N Technologies SecurityGateway 1.0.1 allows remote attackers t
60RISK
open ↗
Referência
CVE-2026-19765
CVE-2026-19765MEDIUM
eyaushev swagger-testcase-mcp fetch_swagger swagger-parser.ts loadSource server-side request forgery
33RISK
open ↗
Referência✓ VexDay Proof
exV2 < 2.0.4.3 - 'sort' SQL Injection
CVE-2006-5030—webappsphp
SQL injection vulnerability in modules/messages/index.php in exV2 2.0.4.3 and earlier allows remote authenticated users
23RISK
open ↗
Referência
CVE-2026-15311
CVE-2026-15311MEDIUM
NousResearch hermes-agent Matrix Adapter matrix.py MatrixAdapter._markdown_to_html cross site scripting
33RISK
open ↗
Referência✓ VexDay Proof
Gonafish LinksCaffePRO 4.5 - 'index.php' SQL Injection
CVE-2008-4202—webappsphp
SQL injection vulnerability in index.php in Gonafish LinksCaffePRO 4.5 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2026-15535
CVE-2026-15535MEDIUM
AkariAsai self-rag retrieval_lm index.py Indexer.deserialize_from deserialization
33RISK
open ↗
Referência✓ VexDay Proof
Unreal Tournament 3 1.3 - Directory Traversal
CVE-2008-4243—remotewindows
Directory traversal vulnerability in ImageServer (aka UTImageServer) in WebAdmin before 1.7 for Epic Games Unreal Tourna
23RISK
open ↗
Referência
CVE-2026-15531
CVE-2026-15531MEDIUM
yashbhalgat HashNeRF-pytorch Checkpoint File run_nerf.py torch.load deserialization
33RISK
open ↗
Referência
CVE-2026-15530
CVE-2026-15530MEDIUM
WuzhiCMS Attachment API index.php listimage information disclosure
33RISK
open ↗
Referência
CVE-2026-19074
CVE-2026-19074MEDIUM
Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure
33RISK
open ↗
Referência
CVE-2026-18786
CVE-2026-18786HIGH
CheckView < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass
41RISK
open ↗
Referência✓ VexDay Proof
phpsmartcom 0.2 - Local File Inclusion / SQL Injection
CVE-2008-4352—webappsphp
SQL injection vulnerability in inc/pages/viewprofile.php in phpSmartCom 0.2 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2026-14652
CVE-2026-14652MEDIUM
SourceCodester Simple and Nice Shopping Cart Script Admin Login login.php sql injection
33RISK
open ↗
Referência
CVE-2026-86221
CVE-2026-86221MEDIUM
SourceCodester Class and Exam Timetabling System modal_add_course1.php mysqli_query sql injection
33RISK
open ↗
Referência
CVE-2013-3532
CVE-2013-3532—
SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote
23RISK
open ↗
Referência
CVE-2026-19006
CVE-2026-19006MEDIUM
mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization
33RISK
open ↗
Referência
CVE-2026-67623
CVE-2026-67623HIGH
Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook
41RISK
open ↗
Referência
Soosyze CMS 2.0 - Brute Force Login
CVE-2025-52392MEDIUMwebappsmultiple
Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout m
33RISK
open ↗
Referência
CVE-2026-13528
CVE-2026-13528MEDIUM
YunaiV/zhijiantianya ruoyi-vue-pro AppFileController File Upload Endpoint FileServiceImpl.java generateUploadPath path traversal
33RISK
open ↗
Referência
CVE-2026-12220
CVE-2026-12220HIGH
Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflow
41RISK
open ↗
Referência
CVE-2026-59102
CVE-2026-59102LOW
Forgejo < 15.0.3 - Stored XSS via Actions Run Full Name Rendering
28RISK
open ↗
Referência
CVE-2026-14769
CVE-2026-14769MEDIUM
code-projects Real State Services pay.php sql injection
33RISK
open ↗
← previouspage 786 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.