Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2026-5630
assafelovic gpt-researcher Report API app.py cross site scripting
33RISK
open ↗Referência
CVE-2026-5628
Belkin F9K1015 Setting formSetSystemSettings stack-based overflow
41RISK
open ↗Referência
CVE-2026-5625
assafelovic gpt-researcher WebSocket researcher.py cross site scripting
33RISK
open ↗Referência
CVE-2026-5620
itsourcecode Construction Management System Parameter borrowed_equip_report.php sql injection
33RISK
open ↗Referência
CVE-2026-5619
Braffolk mcp-summarization-functions summarize_command mcp-server.ts os command injection
33RISK
open ↗Referência
CVE-2026-5618
kalcaddle kodbox shareMake/shareCheck server-side request forgery
33RISK
open ↗Referência
CVE-2026-5615
givanz Vvvebjs File Upload Endpoint upload.php cross site scripting
48RISK
open ↗Referência
CVE-2019-0796
An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), ak
23RISK
open ↗Referência
CVE-2026-115246
subhajitkhan online-clinic-management-system patdocmsg.php cross site scripting
33RISK
open ↗Referência
CVE-2026-12813
activepieces File URL file.ts handleUrlFile server-side request forgery
33RISK
open ↗Referência✓ VexDay Proof
Eserv 3.x - FTP Server (ABOR) Remote Stack Overflow (PoC)
Stack-based buffer overflow in the FTP server in Etype Eserv 3.x, possibly 3.26, allows remote attackers to cause a deni
23RISK
open ↗Referência✓ VexDay Proof
SezHoo 0.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in SezHooTabsAndActions.php in SezHoo 0.1 allows remote attackers to execute arb
23RISK
open ↗Referência
CVE-2016-2494
Off-by-one error in sdcard/sdcard.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before
23RISK
open ↗Referência✓ VexDay Proof
X7 Chat 2.0.1A1 - Local File Inclusion
Directory traversal vulnerability in help/mini.php in X7 Chat 2.0.1 A1 and earlier allows remote attackers to include an
23RISK
open ↗Referência
CVE-2017-1000028
Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Trave
60RISK
open ↗Referência✓ VexDay Proof
Hummingbird Deployment Wizard 2008 - ActiveX Command Execution
Multiple insecure method vulnerabilities in the DeployRun.DeploymentSetup.1 (DeployRun.dll) ActiveX control 10.0.0.44 in
35RISK
open ↗Referência✓ VexDay Proof
db Software Laboratory VImpX - 'VImpX.ocx' Multiple Vulnerabilities
Stack-based buffer overflow in the VImpX.VImpAX ActiveX control (VImpX.ocx) 4.8.8.0 in DB Software Laboratory VImp X, po
23RISK
open ↗Referência
CVE-2013-6826
cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate th
23RISK
open ↗Referência
CVE-2025-71326
AVAST Antivirus 25.11 Unquoted Service Path Privilege Escalation
41RISK
open ↗Referência
CVE-2026-46331
net/sched: fix pedit partial COW leading to page cache corruption
41RISK
open ↗Referência✓ VexDay Proof
KGB 1.87 - Local File Inclusion / Remote Code Execution
Directory traversal vulnerability in kgcall.php in KGB 1.87 allows remote attackers to include and execute arbitrary loc
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component com_extplorer 2.0.0 RC2 - Local Directory Traversal
Directory traversal vulnerability in the eXtplorer module (com_extplorer) 2.0.0 RC2 and earlier in Joomla! allows remote
43RISK
open ↗Referência
CVE-2008-4765
SQL injection vulnerability in pollBooth.php in osCommerce Poll Booth Add-On 2.0 allows remote attackers to execute arbi
23RISK
open ↗Referência
CVE-2026-12210
universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.