Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2026-5330
SourceCodester/mayuri_k Best Courier Management System User Delete ajax.php access control
33RISK
open ↗Referência
CVE-2026-5328
shsuishang modulithshop ProductItemDao ProductIndexServiceImpl.java listItem sql injection
33RISK
open ↗Referência
CVE-2026-5327
efforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injection
33RISK
open ↗Referência
CVE-2026-5326
SourceCodester Leave Application System User Information index.php authorization
33RISK
open ↗Referência
CVE-2026-5325
SourceCodester Simple Customer Relationship Management System Create Ticket create-ticket.php cross site scripting
33RISK
open ↗Referência
CVE-2026-5259
AutohomeCorp frostmourne Alarm Preview AlarmController.java server-side request forgery
33RISK
open ↗Referência
CVE-2026-5258
Sanster IOPaint File Manager file_manager.py _get_file path traversal
33RISK
open ↗Referência
CVE-2026-5257
code-projects Simple Laundry System Parameter delstaffinfo.php sql injection
33RISK
open ↗Referência
CVE-2026-5256
code-projects Simple Laundry System Parameter modify.php sql injection
33RISK
open ↗Referência
CVE-2026-5152
Tenda CH22 createFileName formCreateFileName stack-based overflow
41RISK
open ↗Referência
CVE-2026-5150
code-projects Accounting System Parameter viewin_costumer.php sql injection
33RISK
open ↗Referência
CVE-2026-5126
SourceCodester RSS Feed Parser file_get_contents server-side request forgery
33RISK
open ↗Referência
CVE-2026-5125
raine consult-llm-mcp server.ts child_process.execSync os command injection
33RISK
open ↗Referência
CVE-2018-8732
Cross-site scripting (XSS) vulnerability in WampServer 3.1.1 allows remote attackers to inject arbitrary web script or H
23RISK
open ↗Referência
CVE-2026-18357
WPC Order Tip for WooCommerce < 3.3.1 - Unauthenticated Order Data Disclosure
41RISK
open ↗Referência✓ VexDay Proof
Mantis Bug Tracker 1.1.1 - Code Execution / Cross-Site Scripting / Cross-Site Request Forgery
Eval injection vulnerability in adm_config_set.php in Mantis before 1.1.2 allows remote authenticated administrators to
23RISK
open ↗Referência
CVE-2026-94094
OpenClaw Canvas Host Route server.ts createCanvasHostHandler denial of service
33RISK
open ↗Referência
CVE-2026-19812
TOTOLINK A800R product.so cstecgi.cgi UploadCustomModule stack-based overflow
41RISK
open ↗Referência
CVE-2026-19993
Webkul Bagisto RMA State Validation update-status behavioral workflow
33RISK
open ↗Referência
CVE-2026-19782
WPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users
33RISK
open ↗Referência
CVE-2013-2572
A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 d
28RISK
open ↗Referência
CVE-2013-2572
A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 d
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.