Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2026-9370
ulisesbocchio jasypt-spring-boot Password Hash SimpleGCMConfig.java getSecretKeySaltGenerator hash predictable salt
33RISK
open ↗Referência
CVE-2016-7255
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,
93RISK
open ↗Referência
CVE-2016-7287
The scripting engines in Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary c
35RISK
open ↗Referência✓ VexDay Proof
Move Networks Quantum Streaming Player Control - Remote Buffer Overflow
Stack-based buffer overflow in the Quantum Streaming Player (Quantum Streaming IE Player) ActiveX control (aka QSP2IE.QS
23RISK
open ↗Referência
CVE-2026-8293
Really Simple Security < 9.5.10.1 - Authentication Bypass via Two-Factor OTP Skip
41RISK
open ↗Referência
CVE-2018-4386
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iO
23RISK
open ↗Referência
CVE-2026-10568
itsourcecode Fees Management System manage_payment.php sql injection
33RISK
open ↗Referência
CVE-2022-26986
SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this al
23RISK
open ↗Referência
CVE-2010-5195
Untrusted search path vulnerability in Roxio MyDVD 9 allows local users to gain privileges via a Trojan horse HomeUtils9
23RISK
open ↗Referência
CVE-2026-41468
Beghelli Sicuro24 SicuroWeb AngularJS Sandbox Escape via Template Injection
48RISK
open ↗Referência
CVE-2022-28368
Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (
60RISK
open ↗Referência✓ VexDay Proof
Affiliate Market 0.1 Beta - Cross-Site Scripting / SQL Injection
Cross-site scripting (XSS) vulnerability in function/sideblock.php in Affiliate Market (affmarket) 0.1 BETA allows remot
23RISK
open ↗Referência✓ VexDay Proof
Affiliate Market 0.1 Beta - Cross-Site Scripting / SQL Injection
SQL injection vulnerability in shop/detail.php in Affiliate Market (affmarket) 0.1 BETA allows remote attackers to execu
23RISK
open ↗Referência
CVE-2012-3840
Multiple cross-site scripting (XSS) vulnerabilities in index.php/users/form/user_id in MyClientBase 0.12 allow remote at
23RISK
open ↗Referência
CVE-2026-10177
Aider-AI Aider AWS EC2 Metadata Endpoint api_docs.py requests.get server-side request forgery
33RISK
open ↗Referência
CVE-2018-25396
Heatmiser Wifi Thermostat 1.7 Credential Disclosure via networkSetup.htm
41RISK
open ↗Referência
CVE-2018-4937
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exp
28RISK
open ↗Referência
CVE-2018-17384
SQL Injection exists in the Swap Factory 2.2.1 component for Joomla! via the filter_order_Dir or filter_order parameter.
23RISK
open ↗Referência
CVE-2026-7407
SourceCodester Pizzafy Ecommerce System Setting ajax.php save_settings sql injection
33RISK
open ↗Referência
CVE-2026-7404
getsimpletool mcpo-simple-server base_manager.py delete_shared_prompt path traversal
33RISK
open ↗Referência
CVE-2026-6182
code-projects Simple Content Management System login.php sql injection
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.