Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2026-107508
Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter
41RISK
open ↗Referência✓ VexDay Proof
Quick Poll Script - 'id' SQL Injection
SQL injection vulnerability in code.php in Quick Poll Script allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Referência✓ VexDay Proof
osTicket 1.12 - Persistent Cross-Site Scripting
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It w
43RISK
open ↗Referência
CVE-2026-109109
Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow
48RISK
open ↗Referência
CVE-2014-4873
SQL injection vulnerability in TrackItWeb/Grid/GetData in BMC Track-It! 11.3.0.355 allows remote authenticated users to
23RISK
open ↗Referência
CVE-2016-4203
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acro
28RISK
open ↗Referência
CVE-2025-64446
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb
100RISK
open ↗Referência
CVE-2026-69111
Milvus 2.6.22, 3.0.0 Unauthenticated Denial of Service via /management/stop
41RISK
open ↗Referência
CVE-2014-5073
vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands
60RISK
open ↗Referência
CVE-2026-88785
Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String
33RISK
open ↗Referência
CVE-2016-7567
Buffer overflow in the SLPFoldWhiteSpace function in common/slp_compare.c in OpenSLP 2.0 allows remote attackers to have
28RISK
open ↗Referência✓ VexDay Proof
Brim 1.2.1 - 'renderer' Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Barry Nauta BRIM 1.2.1 and earlier allow remote attackers to execu
23RISK
open ↗Referência
CVE-2016-7661
An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. The is
23RISK
open ↗Referência
CVE-2026-87764
BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message
41RISK
open ↗Referência✓ VexDay Proof
PHPPowerCards 2.10 - 'txt.inc.php' Remote Code Execution
Multiple direct static code injection vulnerabilities in db/txt.inc.php in phpPowerCards 2.10, when register_globals is
23RISK
open ↗Referência
CVE-2019-1619
Cisco Data Center Network Manager Authentication Bypass Vulnerability
85RISK
open ↗Referência
CVE-2016-9651
A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a
28RISK
open ↗Referência
CVE-2014-5468
A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cf
50RISK
open ↗Referência
CVE-2019-1652
Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.