Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2026-19784
CVE-2026-19784MEDIUM
francoisjacquet RosarioSIS Referrals.php DBUpdate authorization
33RISK
open ↗
Referência
CVE-2026-66729
CVE-2026-66729HIGH
facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser
41RISK
open ↗
Referência
CVE-2016-4655
CVE-2016-4655MEDIUMunder attack
The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.
90RISK
open ↗
Referência
CVE-2026-19771
CVE-2026-19771HIGH
Baicells EG3661M LuCI Web luci os command injection
41RISK
open ↗
Referência
CVE-2026-10153
CVE-2026-10153MEDIUM
westboy CicadasCMS AbstractCacheManager.java search cross site scripting
33RISK
open ↗
Referência
CVE-2026-5613
CVE-2026-5613HIGH
Belkin F9K1015 formReboot stack-based overflow
41RISK
open ↗
Referência
CVE-2026-5612
CVE-2026-5612HIGH
Belkin F9K1015 formWlEncrypt stack-based overflow
41RISK
open ↗
Referência
CVE-2026-5669
CVE-2026-5669MEDIUM
Cyber-III Student-Management-System Parameter login.php sql injection
33RISK
open ↗
Referência
CVE-2026-5637
CVE-2026-5637MEDIUM
projectworlds Car Rental System Parameter message_admin.php sql injection
33RISK
open ↗
Referência
CVE-2026-5636
CVE-2026-5636MEDIUM
PHPGurukul Online Shopping Portal Project Parameter cancelorder.php sql injection
33RISK
open ↗
Referência
CVE-2026-5635
CVE-2026-5635MEDIUM
PHPGurukul Online Shopping Portal Project Parameter categorywise-products.php sql injection
33RISK
open ↗
Referência
CVE-2009-4469
CVE-2009-4469—
Multiple cross-site scripting (XSS) vulnerabilities in pagenumber.inc.php in phpPowerCards 2.0 allow remote attackers to
23RISK
open ↗
Referência
CVE-2026-4332
CVE-2026-4332MEDIUM
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
33RISK
open ↗
Referência
CVE-2026-4916
CVE-2026-4916LOW
Missing Authorization in GitLab
28RISK
open ↗
Referência
CVE-2026-12688
CVE-2026-12688MEDIUM
ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery
33RISK
open ↗
Referência
CVE-2026-86165
CVE-2026-86165CRITICAL
Tenda HG10 formURL buffer overflow
48RISK
open ↗
Referência
CVE-2026-16763
CVE-2026-16763MEDIUM
localstack serverless-localstack Configuration index.js os command injection
33RISK
open ↗
Referência
CVE-2026-14440
CVE-2026-14440HIGH
Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records
41RISK
open ↗
Referência
CVE-2026-15039
CVE-2026-15039CRITICAL
Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload
48RISK
open ↗
Referência
CVE-2025-15687
CVE-2025-15687MEDIUM
Open5GS SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb denial of service
33RISK
open ↗
Referência
CVE-2026-65708
CVE-2026-65708HIGH
sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController
41RISK
open ↗
Referência
CVE-2026-58451
CVE-2026-58451HIGH
Horde IMP < 7.0.1 Path Traversal via Compose.php img src
41RISK
open ↗
Referência✓ VexDay Proof
Seditio CMS 121 - SQL Injection
CVE-2007-6202—webappsphp
SQL injection vulnerability in plugins/search/search.php in Neocrome Seditio CMS 121 and earlier allows remote attackers
23RISK
open ↗
Referência
CVE-2026-13552
CVE-2026-13552MEDIUM
itsourcecode Online Hotel Management System controller.php edit sql injection
33RISK
open ↗
Referência
CVE-2026-13551
CVE-2026-13551MEDIUM
itsourcecode Baptism Information Management System editBaptism.php sql injection
33RISK
open ↗
Referência
CVE-2026-13550
CVE-2026-13550MEDIUM
itsourcecode Baptism Information Management System delbaptism.php sql injection
33RISK
open ↗
Referência
CVE-2010-4280
CVE-2010-4280—
Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary
23RISK
open ↗
Referência
CVE-2017-7690
CVE-2017-7690—
Proxifier for Mac before 2.19.2, when first run, allows local users to gain privileges by replacing the KLoader binary w
23RISK
open ↗
Referência✓ VexDay Proof
alitalk 1.9.1.1 - Multiple Vulnerabilities
CVE-2008-0391—webappsphp
inc/elementz.php in aliTalk 1.9.1.1 does not properly verify authentication, which allows remote attackers to add an arb
23RISK
open ↗
Referência
CVE-2026-6878
CVE-2026-6878MEDIUM
ByteDance verl grader.py math_equal sandbox
33RISK
open ↗
← previouspage 807 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.