Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits

40,922CVEs with public exploitation

24,696lab-tested

All Referência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

26,560 exploits

Referência

CVE-2026-103543

CVE-2026-103543MEDIUM

itsourcecode Leave Management System controller.php sql injection

33RISK

open ↗

Referência

CVE-2026-14607

CVE-2026-14607MEDIUM

RT-Thread lwp_syscall.c sys_getaddrinfo memory corruption

33RISK

open ↗

Referência

CVE-2026-90801

CVE-2026-90801MEDIUM

GNU Binutils ld cache.c cache_bwrite buffer overflow

33RISK

open ↗

Referência

CVE-2005-2428

CVE-2005-2428—

Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hid

60RISK

open ↗

Referência

CVE-2017-10204

CVE-2017-10204—

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version

23RISK

open ↗

Referência

CVE-2020-16040

CVE-2020-16040—

Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially explo

60RISK

open ↗

Referência

CVE-2017-13209

CVE-2017-13209—

In the ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on the

23RISK

open ↗

Referência

CVE-2017-13794

CVE-2017-13794—

An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud

23RISK

open ↗

Referência

CVE-2026-14211

CVE-2026-14211LOW

Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR

28RISK

open ↗

Referência

CVE-2017-14955

CVE-2017-14955—

Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, whi

28RISK

open ↗

Referência✓ VexDay Proof

Check New 4.52 - SQL Injection

CVE-2008-5586—webappsphp

SQL injection vulnerability in findoffice.php in Check Up New Generation (aka Check New) 4.52, when magic_quotes_gpc is

23RISK

open ↗

Referência

CVE-2017-14956

CVE-2017-14956—

AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the "/

23RISK

open ↗

Referência

CVE-2018-17391

CVE-2018-17391—

SQL Injection exists in authors_post.php in Super Cms Blog Pro 1.0 via the author parameter.

23RISK

open ↗

Referência

CVE-2018-17391

CVE-2018-17391—

SQL Injection exists in authors_post.php in Super Cms Blog Pro 1.0 via the author parameter.

23RISK

open ↗

Referência

CVE-2020-16040

CVE-2020-16040—

Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially explo

60RISK

open ↗

Referência

CVE-2026-102912

CVE-2026-102912MEDIUM

SourceCodester Online Leave Management System page reports sql injection

33RISK

open ↗

Referência✓ VexDay Proof

RankEm - 'siteID' SQL Injection

CVE-2008-5588—webappsasp

SQL injection vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência

CVE-2026-11342

CVE-2026-11342MEDIUM

code-projects Hotel and Tourism Reservation System details.php sql injection

33RISK

open ↗

Referência

CVE-2014-3427

CVE-2014-3427—

CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary

23RISK

open ↗

Referência

CVE-2014-6038

CVE-2014-6038—

Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerabili

60RISK

open ↗

Referência✓ VexDay Proof

saPHP Lesson 2.0 - 'forumid' SQL Injection

CVE-2005-3363—webappsphp

SQL injection vulnerability in Saphp Lesson, possibly saphp Lesson1.1 and saphpLesson2.0, allows remote attackers to exe

23RISK

open ↗

Referência

CVE-2014-6043

CVE-2014-6043—

ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 does not properly restrict access to the database

28RISK

open ↗

Referência

CVE-2012-1022

CVE-2012-1022—

SQL injection vulnerability in admin/categories.php in 4images 1.7.10 remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2019-25729

CVE-2019-25729CRITICAL

PDF Signer 3.0 Server-Side Template Injection RCE via CSRF Cookie

48RISK

open ↗

Referência

CVE-2026-10802

CVE-2026-10802MEDIUM

keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption

33RISK

open ↗

Referência

CVE-2014-9331

CVE-2014-9331—

Cross-site request forgery (CSRF) vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote

23RISK

open ↗

Referência

CVE-2026-10801

CVE-2026-10801LOW

modelscope ms-swift PIL Image Cache Key base.py Template._save_pil_image weak hash

28RISK

open ↗

Referência

CVE-2026-19207

CVE-2026-19207MEDIUM

PHPGurukul Company Visitor Management System manage-newvisitors.php cross site scripting

33RISK

open ↗

Referência

CVE-2014-4035

CVE-2014-4035—

Cross-site scripting (XSS) vulnerability in booking_details.php in Best Soft Inc. (BSI) Advance Hotel Booking System 2.0

23RISK

open ↗

Referência

CVE-2026-13600

CVE-2026-13600HIGH

AutoNetTV Relay < 3.0.14 - Unauthenticated Privilege Escalation via Scheduled Sync Cron

41RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.