Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,681cataloged exploits
40,948CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,433VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência✓ VexDay Proof
SoftBB 0.1 - 'cmd' Remote Command Execution
CVE-2006-4633—webappsphp
index.php in SoftBB 0.1, and possibly earlier, allows remote attackers to obtain the installation path via a null or inv
23RISK
open ↗
Referência
CVE-2026-82698
CVE-2026-82698MEDIUM
sambitraj Student-Management-System aca.sql default password
33RISK
open ↗
Referência
CVE-2016-5674
CVE-2016-5674—
__debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR Rea
60RISK
open ↗
Referência✓ VexDay Proof
Muratsoft Haber Portal 3.6 - 'tr' SQL Injection
CVE-2006-4641—webappsasp
SQL injection vulnerability in kategori.asp in Muratsoft Haber Portal 3.6 allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência
CVE-2026-12971
CVE-2026-12971LOW
LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature
28RISK
open ↗
Referência
CVE-2018-10809
CVE-2018-10809—
In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD)
23RISK
open ↗
Referência
CVE-2018-10933
CVE-2018-10933CRITICAL
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul
85RISK
open ↗
Referência
CVE-2022-24112
CVE-2022-24112CRITICALunder attack
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
100RISK
open ↗
Referência
Joomla! Component JMS Music 1.1.1 - SQL Injection
CVE-2018-6581—webappsphp
SQL Injection exists in the JMS Music 1.1.1 component for Joomla! via a search with the keyword, artist, or username par
23RISK
open ↗
Referência
CVE-2016-8655
CVE-2016-8655—
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cau
43RISK
open ↗
Referência
CVE-2017-16237
CVE-2017-16237—
In Vir.IT eXplorer Anti-Virus before 8.5.42, the driver file (VIAGLT64.SYS) contains an Arbitrary Write vulnerability be
23RISK
open ↗
Referência
CVE-2017-17579
CVE-2017-17579—
FS Freelancer Clone 1.0 has SQL Injection via the profile.php u parameter.
23RISK
open ↗
Referência
CVE-2022-24637
CVE-2022-24637—
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, wh
60RISK
open ↗
Referência
CVE-2022-24637
CVE-2022-24637—
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, wh
60RISK
open ↗
Referência
CVE-2026-16547
CVE-2026-16547MEDIUM
REST API Log < 1.7.1 - Unauthenticated Sensitive Log Data Disclosure via Download Endpoint
33RISK
open ↗
Referência✓ VexDay Proof
PhotoKorn Gallery 1.52 - 'dir_path' Remote File Inclusion
CVE-2006-4670—webappsphp
Multiple PHP remote file inclusion vulnerabilities in PhotoKorn Gallery 1.52 and earlier allow remote attackers to execu
28RISK
open ↗
Referência
CVE-2026-15939
CVE-2026-15939LOW
Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST API
28RISK
open ↗
Referência
CVE-2026-17433
CVE-2026-17433MEDIUM
nanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization
33RISK
open ↗
Referência
CVE-2026-17032
CVE-2026-17032CRITICAL
Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server
48RISK
open ↗
Referência
CVE-2026-16948
CVE-2026-16948HIGH
Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure
41RISK
open ↗
Referência
CVE-2004-2502
CVE-2004-2502—
im-switch before 11.4-46.1 in Fedora Core 2 allows local users to overwrite arbitrary files via a symlink attack on the
23RISK
open ↗
Referência
CVE-2026-16267
CVE-2026-16267HIGH
Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field
41RISK
open ↗
Referência
CVE-2017-17111
CVE-2017-17111—
Posty Readymade Classifieds Script 1.0 allows an attacker to inject SQL commands via a listings.php?catid= or ads-detail
23RISK
open ↗
Referência
CVE-2026-14222
CVE-2026-14222LOW
Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization
28RISK
open ↗
Referência
CVE-2026-13342
CVE-2026-13342MEDIUM
Security Optimizer – The All-In-One Protection Plugin < 1.6.5 - Login Access IP Allowlist Bypass via post_password
33RISK
open ↗
Referência
CVE-2026-19243
CVE-2026-19243MEDIUM
HKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injection
33RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module Core - 'viewcat.php' SQL Injection
CVE-2007-1814—webappsphp
SQL injection vulnerability in viewcat.php in the Core module for Xoops allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2026-14820
CVE-2026-14820MEDIUM
Quiz And Survey Master < 11.1.3 - Unauthenticated User Enumeration and Password Oracle via Quiz Login
33RISK
open ↗
Referência
CVE-2017-17617
CVE-2017-17617—
Foodspotting Clone Script 1.0 has SQL Injection via the quicksearch.php q parameter.
23RISK
open ↗
Referência
CVE-2021-39316
CVE-2021-39316HIGH
ZoomSounds <= 6.45 Unauthenticated Directory Traversal and Sensitive Information Dislosure
68RISK
open ↗
← previouspage 820 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.