Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência✓ VexDay Proof
Web Directory Script 1.5.3 - 'site' SQL Injection
CVE-2008-4091—webappsphp
SQL injection vulnerability in index.php in Web Directory Script 1.5.3 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Autodealers CMS AutOnline - 'id' SQL Injection
CVE-2008-4074—webappsphp
SQL injection vulnerability in index.php in Zanfi Autodealers CMS AutOnline allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2015-1482
CVE-2015-1482—
Ansible Tower (aka Ansible UI) before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive inform
23RISK
open ↗
Referência
CVE-2019-0708
CVE-2019-0708CRITICALunder attackransomware
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RISK
open ↗
Referência
CVE-2026-19077
CVE-2026-19077MEDIUM
Copy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization
33RISK
open ↗
Referência
CVE-2026-7160
CVE-2026-7160HIGH
Tenda HG3 formTracert command injection
41RISK
open ↗
Referência
CVE-2026-7159
CVE-2026-7159MEDIUM
douinc mkdocs-mcp-plugin server.py list_documents path traversal
33RISK
open ↗
Referência
CVE-2026-7158
CVE-2026-7158MEDIUM
dmitryglhf mcp-url-downloader server.py _validate_url_safe server-side request forgery
33RISK
open ↗
Referência
CVE-2026-7157
CVE-2026-7157MEDIUM
disler aider-mcp-server aider_ai_code server.py command injection
33RISK
open ↗
Referência
CVE-2026-7156
CVE-2026-7156CRITICAL
Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection
48RISK
open ↗
Referência
CVE-2026-7155
CVE-2026-7155CRITICAL
Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection
48RISK
open ↗
Referência
CVE-2026-7154
CVE-2026-7154CRITICAL
Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection
48RISK
open ↗
Referência
CVE-2026-7153
CVE-2026-7153CRITICAL
Totolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection
48RISK
open ↗
Referência
CVE-2026-7152
CVE-2026-7152CRITICAL
Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection
48RISK
open ↗
Referência
CVE-2026-7151
CVE-2026-7151HIGH
Tenda HG3 formIPv6Routing formUploadConfig stack-based overflow
41RISK
open ↗
Referência
CVE-2026-7150
CVE-2026-7150MEDIUM
dh1011 auto-favicon MCP Tool server.py generate_favicon_from_url server-side request forgery
33RISK
open ↗
Referência
CVE-2026-7149
CVE-2026-7149MEDIUM
dexhunter kaggle-mcp server.py prepare_kaggle_dataset path traversal
33RISK
open ↗
Referência
CVE-2026-7148
CVE-2026-7148MEDIUM
CodeAstro Online Classroom addnewfaculty sql injection
33RISK
open ↗
Referência
CVE-2026-7147
CVE-2026-7147MEDIUM
JoeCastrom mcp-chat-studio LLM Models API llm.js server-side request forgery
33RISK
open ↗
Referência
CVE-2026-7200
CVE-2026-7200MEDIUM
SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-7199
CVE-2026-7199MEDIUM
SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
33RISK
open ↗
Referência
CVE-2026-7196
CVE-2026-7196MEDIUM
CodeAstro Online Classroom guestdetails sql injection
33RISK
open ↗
Referência
CVE-2026-7194
CVE-2026-7194MEDIUM
SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
33RISK
open ↗
Referência
CVE-2026-7179
CVE-2026-7179MEDIUM
OSPG binwalk WinCE Extraction Plugin winceextract.py read_null_terminated_string path traversal
33RISK
open ↗
Referência
CVE-2026-7178
CVE-2026-7178MEDIUM
ChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgery
33RISK
open ↗
Referência
CVE-2026-7177
CVE-2026-7177MEDIUM
ChatGPTNextWeb NextChat route.ts proxyHandler server-side request forgery
33RISK
open ↗
Referência✓ VexDay Proof
phpsmartcom 0.2 - Local File Inclusion / SQL Injection
CVE-2008-4352—webappsphp
SQL injection vulnerability in inc/pages/viewprofile.php in phpSmartCom 0.2 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2026-14652
CVE-2026-14652MEDIUM
SourceCodester Simple and Nice Shopping Cart Script Admin Login login.php sql injection
33RISK
open ↗
Referência
CVE-2026-86221
CVE-2026-86221MEDIUM
SourceCodester Class and Exam Timetabling System modal_add_course1.php mysqli_query sql injection
33RISK
open ↗
Referência
CVE-2013-3532
CVE-2013-3532—
SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote
23RISK
open ↗
← previouspage 801 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.