Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,678cataloged exploits
40,947CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,430VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-8724
CVE-2026-8724MEDIUM
Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection
33RISK
open ↗
Referência
CVE-2026-9810
CVE-2026-9810CRITICAL
AI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuth
48RISK
open ↗
Referência
CVE-2017-1000353
CVE-2017-1000353CRITICALunder attack
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code exe
100RISK
open ↗
Referência
CVE-2020-37168
CVE-2020-37168CRITICAL
Ecommerce Systempay 1.0 Production Key Brute Force
48RISK
open ↗
Referência
CVE-2017-1000353
CVE-2017-1000353CRITICALunder attack
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code exe
100RISK
open ↗
Referência
CVE-2017-12786
CVE-2017-12786—
Network interfaces of the cliengine and noviengine services, included in the NoviWare software distribution through NW40
28RISK
open ↗
Referência
CVE-2017-14153
CVE-2017-14153—
This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. An attacker must
23RISK
open ↗
Referência
CVE-2017-14798
CVE-2017-14798HIGH
local privilege escalation in SUSE postgresql init script
41RISK
open ↗
Referência
Anuko Time Tracker 1.19.23.5325 - CSV/Formula Injection
CVE-2020-15255HIGHwebappsphp
CSV injection in Anuko Time Tracker
41RISK
open ↗
Referência
CVE-2011-5204
CVE-2011-5204—
Akiva WebBoard 8.x stores passwords in plaintext, which allows local users to obtain sensitive information by reading fr
23RISK
open ↗
Referência
CVE-2018-15844
CVE-2018-15844—
An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's pas
23RISK
open ↗
Referência
CVE-2026-8207
CVE-2026-8207HIGH
Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/gr
41RISK
open ↗
Referência
CVE-2021-47929
CVE-2021-47929MEDIUM
WordPress Plugin Filterable Portfolio Gallery 1.0 Stored XSS
33RISK
open ↗
Referência
CVE-2021-47928
CVE-2021-47928HIGH
Opencart TMD Vendor System 3.x Blind SQL Injection via product route
41RISK
open ↗
Referência
CVE-2021-47923
CVE-2021-47923CRITICAL
OpenCart 3.0.3.8 Session Fixation via OCSESSID Cookie
48RISK
open ↗
Referência
CVE-2017-14839
CVE-2017-14839—
TeamWork Photo Fusion allows Arbitrary File Upload in changeAvatar and changeCover.
23RISK
open ↗
Referência
CVE-2026-103543
CVE-2026-103543MEDIUM
itsourcecode Leave Management System controller.php sql injection
33RISK
open ↗
Referência
CVE-2026-14607
CVE-2026-14607MEDIUM
RT-Thread lwp_syscall.c sys_getaddrinfo memory corruption
33RISK
open ↗
Referência
CVE-2026-90801
CVE-2026-90801MEDIUM
GNU Binutils ld cache.c cache_bwrite buffer overflow
33RISK
open ↗
Referência
CVE-2005-2428
CVE-2005-2428—
Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hid
60RISK
open ↗
Referência
CVE-2014-8687
CVE-2014-8687—
Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root
50RISK
open ↗
Referência
CVE-2026-76988
CVE-2026-76988MEDIUM
liftoff-sr CIPster ForwardOpen cipconnectionmanager.cc forward_open out-of-bounds
33RISK
open ↗
Referência
CVE-2026-19964
CVE-2026-19964MEDIUM
Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injection
33RISK
open ↗
Referência
CVE-2011-5283
CVE-2011-5283—
Cross-site scripting (XSS) vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Expre
23RISK
open ↗
Referência
CVE-2026-18781
CVE-2026-18781HIGH
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass
41RISK
open ↗
Referência
CVE-2026-76987
CVE-2026-76987MEDIUM
liftoff-sr CIPster Generic Attribute Logic ciptypes.h SetAttrData memory corruption
33RISK
open ↗
Referência
CVE-2026-34022
CVE-2026-34022HIGH
Weak custom cryptography and hard-coded keys in Wertheim SafeController 65000 allow traffic decryption
41RISK
open ↗
Referência
CVE-2011-5283
CVE-2011-5283—
Cross-site scripting (XSS) vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Expre
23RISK
open ↗
Referência
CVE-2026-19709
CVE-2026-19709MEDIUM
Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass
33RISK
open ↗
Referência
CVE-2026-75087
CVE-2026-75087MEDIUM
itsourcecode Hospital Management System viewdepartment.php sql injection
33RISK
open ↗
← previouspage 817 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.