Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2026-8272
CVE-2026-8272MEDIUM
D-Link DNS-320 webfile_mgr.cgi chown os command injection
33RISK
open ↗
Referência
CVE-2026-8271
CVE-2026-8271MEDIUM
D-Link DNS-320 network_mgr.cgi cgi_upnp_edit os command injection
33RISK
open ↗
Referência
CVE-2026-8269
CVE-2026-8269MEDIUM
Open5GS SMF smf_nsmf_handle_create_sm_context denial of service
33RISK
open ↗
Referência
CVE-2026-8305
CVE-2026-8305MEDIUM
OpenClaw bluebubbles Webhook monitor.ts handleBlueBubblesWebhookRequest improper authentication
33RISK
open ↗
Referência
CVE-2026-8288
CVE-2026-8288MEDIUM
Open5GS SMF gsm-handler.c denial of service
33RISK
open ↗
Referência
CVE-2017-10204
CVE-2017-10204—
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version
23RISK
open ↗
Referência
CVE-2020-16040
CVE-2020-16040—
Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially explo
60RISK
open ↗
Referência
CVE-2017-13209
CVE-2017-13209—
In the ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on the
23RISK
open ↗
Referência
CVE-2017-13794
CVE-2017-13794—
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud
23RISK
open ↗
Referência
CVE-2026-14211
CVE-2026-14211LOW
Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR
28RISK
open ↗
Referência
CVE-2017-14955
CVE-2017-14955—
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, whi
28RISK
open ↗
Referência✓ VexDay Proof
Check New 4.52 - SQL Injection
CVE-2008-5586—webappsphp
SQL injection vulnerability in findoffice.php in Check Up New Generation (aka Check New) 4.52, when magic_quotes_gpc is
23RISK
open ↗
Referência
CVE-2017-14956
CVE-2017-14956—
AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the "/
23RISK
open ↗
Referência
CVE-2018-17391
CVE-2018-17391—
SQL Injection exists in authors_post.php in Super Cms Blog Pro 1.0 via the author parameter.
23RISK
open ↗
Referência
CVE-2018-17391
CVE-2018-17391—
SQL Injection exists in authors_post.php in Super Cms Blog Pro 1.0 via the author parameter.
23RISK
open ↗
Referência
CVE-2020-16040
CVE-2020-16040—
Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially explo
60RISK
open ↗
Referência
CVE-2026-102912
CVE-2026-102912MEDIUM
SourceCodester Online Leave Management System page reports sql injection
33RISK
open ↗
Referência✓ VexDay Proof
RankEm - 'siteID' SQL Injection
CVE-2008-5588—webappsasp
SQL injection vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência
CVE-2014-9014
CVE-2014-9014—
Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin b
28RISK
open ↗
Referência
CVE-2018-5755
CVE-2018-5755—
Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.
23RISK
open ↗
Referência
CVE-2026-12218
CVE-2026-12218HIGH
Yealink SIP-T46U Web FastCGI Service beforewifitest StartReportInformation stack-based overflow
41RISK
open ↗
Referência
CVE-2026-108705
CVE-2026-108705MEDIUM
CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import
33RISK
open ↗
Referência
CVE-2026-11457
CVE-2026-11457MEDIUM
erzhongxmu JeeWMS JimuReport test-connection Endpoint testConnection injection
33RISK
open ↗
Referência
CVE-2012-1022
CVE-2012-1022—
SQL injection vulnerability in admin/categories.php in 4images 1.7.10 remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2019-25729
CVE-2019-25729CRITICAL
PDF Signer 3.0 Server-Side Template Injection RCE via CSRF Cookie
48RISK
open ↗
Referência
CVE-2026-10802
CVE-2026-10802MEDIUM
keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption
33RISK
open ↗
Referência
CVE-2014-9331
CVE-2014-9331—
Cross-site request forgery (CSRF) vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote
23RISK
open ↗
Referência
CVE-2026-10801
CVE-2026-10801LOW
modelscope ms-swift PIL Image Cache Key base.py Template._save_pil_image weak hash
28RISK
open ↗
Referência
CVE-2026-19207
CVE-2026-19207MEDIUM
PHPGurukul Company Visitor Management System manage-newvisitors.php cross site scripting
33RISK
open ↗
Referência
CVE-2014-4035
CVE-2014-4035—
Cross-site scripting (XSS) vulnerability in booking_details.php in Best Soft Inc. (BSI) Advance Hotel Booking System 2.0
23RISK
open ↗
← previouspage 804 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.