Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,672cataloged exploits
40,945CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,424VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-77945
CVE-2026-77945MEDIUM
TRENDnet TEW-821DAP ssi upload.cgi command injection
33RISK
open ↗
Referência
CVE-2026-13414
CVE-2026-13414MEDIUM
CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax
33RISK
open ↗
Referência
CVE-2017-16836
CVE-2017-16836—
Arris TG1682G devices with Comcast TG1682_2.0s7_PRODse 10.0.59.SIP.PC20.CT software allow Unauthenticated Stored XSS via
23RISK
open ↗
Referência✓ VexDay Proof
MiniBB 2.0.2 - 'bb_func_txt.php' Remote File Inclusion
CVE-2006-5673—webappsphp
PHP remote file inclusion vulnerability in bb_func_txt.php in miniBB 2.0.2 and earlier, when register_globals is enabled
23RISK
open ↗
Referência✓ VexDay Proof
MySource CMS 2.16.2 - 'init_mysource.php' Remote File Inclusion
CVE-2006-5672—webappsphp
PHP remote file inclusion vulnerability in web/init_mysource.php in MySource CMS 2.16.2 and earlier allows remote attack
23RISK
open ↗
Referência
CVE-2026-78200
CVE-2026-78200MEDIUM
itsourcecode Library Management System editbooks.php sql injection
33RISK
open ↗
Referência
CVE-2026-72705 — Rocq Guard Checker Accepts Fixpoint Passed as Higher-Order Argument
CVE-2026-72705MEDIUM
Rocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order Argument
33RISK
open ↗
Referência
CVE-2026-78199
CVE-2026-78199MEDIUM
SourceCodester Simple Online Food Ordering System view_prod.php sql injection
33RISK
open ↗
Referência
CVE-2026-14212
CVE-2026-14212MEDIUM
Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR
33RISK
open ↗
Referência
CVE-2026-78161
CVE-2026-78161MEDIUM
warmcat libwebsockets LECP CBOR Recording lecp.c report_raw_cbor out-of-bounds write
33RISK
open ↗
Referência
CVE-2026-56774
CVE-2026-56774MEDIUM
Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID
33RISK
open ↗
Referência
CVE-2017-17573
CVE-2017-17573—
FS Ebay Clone 1.0 has SQL Injection via the product.php id parameter, or the search.php category_id or sub_category_id p
23RISK
open ↗
Referência
CVE-2026-56770
CVE-2026-56770HIGH
libais 0.15 - Out-of-bounds Vector Access in VdmStream::AddLine via Invalid Sequential Message ID
41RISK
open ↗
Referência
CVE-2017-17573
CVE-2017-17573—
FS Ebay Clone 1.0 has SQL Injection via the product.php id parameter, or the search.php category_id or sub_category_id p
23RISK
open ↗
Referência
CVE-2017-17574
CVE-2017-17574—
FS Care Clone 1.0 has SQL Injection via the searchJob.php jobType or jobFrequency parameter.
23RISK
open ↗
Referência✓ VexDay Proof
Omni-NFS Server 5.2 - 'nfsd.exe' Remote Stack Overflow (Metasploit)
CVE-2006-5780—remotewindows
Stack-based buffer overflow in nfsd.exe in XLink Omni-NFS Server 5.2 allows remote attackers to execute arbitrary code v
50RISK
open ↗
Referência
CVE-2017-6998
CVE-2017-6998—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO
23RISK
open ↗
Referência
CVE-2017-8644
CVE-2017-8644—
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose in
28RISK
open ↗
Referência✓ VexDay Proof
SAP Web Application Server 6.40 - Arbitrary File Disclosure
CVE-2006-5784—remotewindows
Unspecified vulnerability in enserver.exe in SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66 a
23RISK
open ↗
Referência
CVE-2017-8646
CVE-2017-8646—
Microsoft Edge in Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in t
35RISK
open ↗
Referência
CVE-2007-2583
CVE-2007-2583—
The in_decimal::set function in item_cmpfunc.cc in MySQL before 5.0.40, and 5.1 before 5.1.18-beta, allows context-depen
28RISK
open ↗
Referência
CVE-2026-59100
CVE-2026-59100LOW
LobeChat 2.2.9 - Broken Object Level Authorization via Chat-Group Agent Operations
28RISK
open ↗
Referência
CVE-2026-16979
CVE-2026-16979MEDIUM
SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration
33RISK
open ↗
Referência
CVE-2026-76574
CVE-2026-76574MEDIUM
code-projects Hospital Information System User Login UsersController.php login sql injection
33RISK
open ↗
Referência
CVE-2026-59099
CVE-2026-59099CRITICAL
Apereo CAS 7.3.0 < 8.0.0-RC6 - AES-GCM Nonce Reuse Information Disclosure
48RISK
open ↗
Referência
CVE-2026-18927
CVE-2026-18927MEDIUM
imranrisal-dev Student-Management-System Shared Upload Helper student_profile_pic.php storeProfileImage unrestricted upload
33RISK
open ↗
Referência
CVE-2026-19191
CVE-2026-19191HIGH
StableBit DrivePool DrivePoolService DrivePool.Service.exe permission
41RISK
open ↗
Referência
CVE-2026-16993
CVE-2026-16993LOW
DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory
28RISK
open ↗
Referência
CVE-2026-16981
CVE-2026-16981MEDIUM
DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR
33RISK
open ↗
Referência
CVE-2026-19020
CVE-2026-19020MEDIUM
itsourcecode Hospital Management System servicetype.php sql injection
33RISK
open ↗
← previouspage 815 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.