Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2026-5570
CVE-2026-5570MEDIUM
Technostrobe HI-LED-WR120-G2 LoginCB index_config improper authentication
33RISK
open ↗
Referência
CVE-2026-5569
CVE-2026-5569MEDIUM
Technostrobe HI-LED-WR120-G2 Endpoint access control
33RISK
open ↗
Referência
CVE-2026-5568
CVE-2026-5568MEDIUM
Akaunting Invoice/Billing cross site scripting
33RISK
open ↗
Referência
CVE-2026-5567
CVE-2026-5567HIGH
Tenda M3 Destination setAdvPolicyData buffer overflow
41RISK
open ↗
Referência
CVE-2026-5566
CVE-2026-5566HIGH
UTT HiPER 1250GW formNatStaticMap strcpy buffer overflow
41RISK
open ↗
Referência
CVE-2026-5565
CVE-2026-5565MEDIUM
code-projects Simple Laundry System Parameter delmemberinfo.php sql injection
33RISK
open ↗
Referência✓ VexDay Proof
CKGold Shopping Cart 2.5 - 'category_id' SQL Injection
CVE-2008-2774—webappsphp
SQL injection vulnerability in item.php in CartKeeper CKGold Shopping Cart 2.5 and 2.7 allows remote attackers to execut
23RISK
open ↗
Referência
CVE-2012-2206
CVE-2012-2206—
The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote authenticated users
23RISK
open ↗
Referência
CVE-2026-103517
CVE-2026-103517MEDIUM
Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged Webhook
33RISK
open ↗
Referência✓ VexDay Proof
traindepot 0.1 - Local File Inclusion / Cross-Site Scripting
CVE-2008-2839—webappsphp
Cross-site scripting (XSS) vulnerability in the search module in Traindepot 0.1 allows remote attackers to inject arbitr
23RISK
open ↗
Referência✓ VexDay Proof
OwnRS blog beta3 - SQL Injection / Cross-Site Scripting
CVE-2008-2855—webappsphp
Cross-site scripting (XSS) vulnerability in clanek.php in OwnRS Beta 3 allows remote attackers to inject arbitrary web s
23RISK
open ↗
Referência
CVE-2024-14037
CVE-2024-14037CRITICAL
Redsea Cloud eHR Unauthenticated File Upload RCE via PtFjk.mob
48RISK
open ↗
Referência
CVE-2013-1763
CVE-2013-1763—
Array index error in the __sock_diag_rcv_msg function in net/core/sock_diag.c in the Linux kernel before 3.7.10 allows l
23RISK
open ↗
Referência
CVE-2014-4936
CVE-2014-4936—
The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE)
43RISK
open ↗
Referência
CVE-2026-11490
CVE-2026-11490MEDIUM
code-projects Online Music Site Search.php sql injection
33RISK
open ↗
Referência✓ VexDay Proof
shibby shop 2.2 - Multiple Vulnerabilities
CVE-2008-2882—webappsphp
upgrade.asp in sHibby sHop 2.2 and earlier does not require administrative authentication, which allows remote attackers
23RISK
open ↗
Referência
CVE-2026-19715
CVE-2026-19715HIGH
WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File
41RISK
open ↗
Referência
CVE-2026-9584
CVE-2026-9584MEDIUM
code-projects Project Management System Login chk.php sql injection
33RISK
open ↗
Referência
CVE-2026-106099
CVE-2026-106099MEDIUM
WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export
33RISK
open ↗
Referência✓ VexDay Proof
Dana IRC 1.3 - Remote Buffer Overflow (PoC)
CVE-2008-2922—doswindows
Stack-based buffer overflow in artegic Dana IRC client 1.3 and earlier allows remote attackers to cause a denial of serv
23RISK
open ↗
Referência
CVE-2026-105975
CVE-2026-105975MEDIUM
CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference
33RISK
open ↗
Referência
CVE-2026-103307
CVE-2026-103307HIGH
Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook
41RISK
open ↗
Referência
CVE-2026-19916
CVE-2026-19916MEDIUM
code-projects Online Food Order System edit_food_items.php cross site scripting
33RISK
open ↗
Referência
CVE-2011-0517
CVE-2011-0517—
Stack-based buffer overflow in Sielco Sistemi Winlog Pro 2.07.00 and earlier, when Run TCP/IP server is enabled, allows
50RISK
open ↗
Referência
CVE-2018-7756
CVE-2018-7756—
RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TCP
35RISK
open ↗
Referência
CVE-2026-58450
CVE-2026-58450MEDIUM
Invoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameter
33RISK
open ↗
Referência✓ VexDay Proof
Visual Basic Enterprise Edition SP6 - 'vb6skit.dll' Buffer Overflow (PoC)
CVE-2008-2959—doswindows
Buffer overflow in a certain ActiveX control (vb6skit.dll) in Microsoft Visual Basic Enterprise Edition 6.0 SP6 might al
28RISK
open ↗
Referência
CVE-2012-2583
CVE-2012-2583—
Cross-site scripting (XSS) vulnerability in Mini Mail Dashboard Widget plugin 1.42 for WordPress allows remote attackers
23RISK
open ↗
Referência
CVE-2013-2586
CVE-2013-2586—
XAMPP 1.8.1 does not properly restrict access to xampp/lang.php, which allows remote attackers to modify xampp/lang.tmp
23RISK
open ↗
Referência
CVE-2014-5189
CVE-2014-5189—
SQL injection vulnerability in lib/optin/optin_page.php in the Lead Octopus plugin for WordPress allows remote attackers
23RISK
open ↗
← previouspage 790 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.