Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2016-4313
Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitra
23RISK
open ↗Referência
CVE-2018-6755
True Key (TK) Windows Client - Weak Directory Permission Vulnerability
41RISK
open ↗Referência✓ VexDay Proof
Black Ice Software Annotation Plugin - 'BiAnno.ocx' Remote Buffer Overflow (2)
Stack-based buffer overflow in BiAnno ActiveX Control (BiAnno.ocx) in Black Ice Software Annotation Plugin 10.95 allows
28RISK
open ↗Referência
CVE-2026-104671
TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX
33RISK
open ↗Referência
CVE-2026-108620
JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatch
33RISK
open ↗Referência
CVE-2026-108618
JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit Endpoint
33RISK
open ↗Referência✓ VexDay Proof
JAMM CMS - 'id' Blind SQL Injection
SQL injection vulnerability in index.php in JAMM CMS allows remote attackers to execute arbitrary SQL commands via the i
23RISK
open ↗Referência
CVE-2026-5574
Technostrobe HI-LED-WR120-G2 FsBrowseClean deletefile authorization
33RISK
open ↗Referência
CVE-2026-5571
Technostrobe HI-LED-WR120-G2 Configuration Data fs information disclosure
33RISK
open ↗Referência
CVE-2026-5570
Technostrobe HI-LED-WR120-G2 LoginCB index_config improper authentication
33RISK
open ↗Referência
CVE-2026-5565
code-projects Simple Laundry System Parameter delmemberinfo.php sql injection
33RISK
open ↗Referência✓ VexDay Proof
CKGold Shopping Cart 2.5 - 'category_id' SQL Injection
SQL injection vulnerability in item.php in CartKeeper CKGold Shopping Cart 2.5 and 2.7 allows remote attackers to execut
23RISK
open ↗Referência
CVE-2026-34108
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text.php
48RISK
open ↗Referência
CVE-2011-0512
SQL injection vulnerability in team.php in the Teams Structure module 3.0 for PHP-Fusion allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
aeDating 4.1 - dir[inc] Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in AEDating 4.1, and possibly earlier versions, allow remote attacker
28RISK
open ↗Referência
CVE-2026-82545
itsourcecode Sales and Inventory System sup_searchfrm.php sql injection
33RISK
open ↗Referência
CVE-2026-34107
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate.php
48RISK
open ↗Referência
CVE-2012-2275
Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijac
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component EXP Shop - 'catid' SQL Injection
SQL injection vulnerability in the EXP Shop (com_expshop) component 1.0 for Joomla! allows remote attackers to execute a
23RISK
open ↗Referência
CVE-2014-5207
fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NOE
23RISK
open ↗Referência
CVE-2013-1605
Buffer overflow in MayGion IP Cameras with firmware before 2013.04.22 (05.53) allows remote attackers to execute arbitra
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.