Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2026-5101
Totolink A3300R Parameter cstecgi.cgi setLanCfg command injection
33RISK
open ↗Referência
CVE-2026-5046
Tenda FH1201 Parameter WrlExtraSet formWrlExtraSet stack-based overflow
41RISK
open ↗Referência
CVE-2026-5106
code-projects Exam Form Submission update_fst.php cross site scripting
33RISK
open ↗Referência
CVE-2026-5105
Totolink A3300R Parameter cstecgi.cgi setVpnPassCfg command injection
33RISK
open ↗Referência
CVE-2026-5198
code-projects Student Membership System Admin Login index.php sql injection
33RISK
open ↗Referência
CVE-2026-5197
code-projects Student Membership System delete_user.php sql injection
33RISK
open ↗Referência
CVE-2026-5196
code-projects Student Membership System delete_member.php sql injection
33RISK
open ↗Referência
CVE-2014-5082
Multiple SQL injection vulnerabilities in admin/admin.php in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus al
23RISK
open ↗Referência
CVE-2016-5399
The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attac
23RISK
open ↗Referência
CVE-2016-7083
VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, when Cortado Thin
23RISK
open ↗Referência
CVE-2018-25381
Joomla Responsive Portfolio 1.6.1 SQL Injection via filter parameters
41RISK
open ↗Referência
CVE-2010-1885
The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server
60RISK
open ↗Referência
CVE-2014-5085
A Command Execution vulnerability exists in Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, whi
23RISK
open ↗Referência
CVE-2026-14627
NousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter._is_allowed_user improper authentication
33RISK
open ↗Referência
CVE-2026-14626
NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service
33RISK
open ↗Referência
CVE-2010-1947
Directory traversal vulnerability in scr/soustab.php in openMairie Openregistrecil 1.02, when register_globals is enable
23RISK
open ↗Referência
CVE-2026-34109
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech.php
48RISK
open ↗Referência
CVE-2018-15884
RICOH MP C4504ex devices allow HTML Injection via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.
23RISK
open ↗Referência
CVE-2014-5112
maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacha
23RISK
open ↗Referência
CVE-2018-16133
Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.
50RISK
open ↗Referência
CVE-2026-13562
Edimax EW-7478APC POST Request formiNICSiteSurvey buffer overflow
41RISK
open ↗Referência
CVE-2014-3220
F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary u
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.