Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,861cataloged exploits
40,956CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,436VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2018-0746
CVE-2018-0746—
The Windows kernel in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Wi
23RISK
open ↗
Referência✓ VexDay Proof
LearnLoop 2.0beta7 - 'sFilePath' Remote File Disclosure
CVE-2007-6214—webappsphp
Directory traversal vulnerability in include/file_download.php in LearnLoop 2.0 beta7 allows remote attackers to read ar
23RISK
open ↗
Referência✓ VexDay Proof
Web-MeetMe 3.0.3 - 'play.php' Remote File Disclosure
CVE-2007-6215—webappsphp
Multiple directory traversal vulnerabilities in play.php in Web-MeetMe 3.0.3 allow remote attackers to read arbitrary fi
23RISK
open ↗
Referência
CVE-2019-0708
CVE-2019-0708CRITICALunder attackransomware
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RISK
open ↗
Referência
CVE-2026-19901
CVE-2026-19901CRITICAL
LB-LINK X-PRO easycwmp hard-coded credentials
48RISK
open ↗
Referência
CVE-2026-82677
CVE-2026-82677MEDIUM
valkey-io valkey Module Timer module.c moduleTimerHandler double free
33RISK
open ↗
Referência
CVE-2020-23972
CVE-2020-23972—
In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating
50RISK
open ↗
Referência✓ VexDay Proof
TualBLOG 1.0 - 'icerikno' SQL Injection
CVE-2006-4793—webappsasp
Multiple SQL injection vulnerabilities in icerik.asp in TualBLOG 1.0 allow remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2018-1000049
CVE-2018-1000049—
Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner
60RISK
open ↗
Referência
CVE-2026-82815
CVE-2026-82815MEDIUM
MegaEase EaseProbe Middleware server.go realIP access control
33RISK
open ↗
Referência
CVE-2018-1000049
CVE-2018-1000049—
Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner
60RISK
open ↗
Referência
CVE-2026-67599
CVE-2026-67599HIGH
ClearOS 7.9 OS Command Injection via Log Viewer filter parameter
41RISK
open ↗
Referência✓ VexDay Proof
gf-3xplorer 2.4 - Cross-Site Scripting / Local File Inclusion
CVE-2007-6474—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in GF-3XPLORER 2.4 allow remote attackers to inject arbitrary web sc
23RISK
open ↗
Referência✓ VexDay Proof
Dokeos 1.8.4 - Arbitrary File Upload
CVE-2007-6479—webappsphp
Unrestricted file upload vulnerability in the "My productions" component for main/auth/profile.php (aka the "My profile"
23RISK
open ↗
Referência
CVE-2026-14318
CVE-2026-14318MEDIUM
GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings
33RISK
open ↗
Referência
CVE-2024-0204
CVE-2024-0204CRITICAL
Authentication Bypass in GoAnywhere MFT
85RISK
open ↗
Referência
CVE-2026-43500
CVE-2026-43500HIGH
rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
78RISK
open ↗
Referência
CVE-2026-10827
CVE-2026-10827LOW
Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes
28RISK
open ↗
Referência
CVE-2020-25790
CVE-2020-25790—
Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archi
28RISK
open ↗
Referência
CVE-2018-1002007
CVE-2018-1002007—
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability re
23RISK
open ↗
Referência
CVE-2020-26887
CVE-2020-26887—
FRITZ!OS before 7.21 on FRITZ!Box devices allows a bypass of a DNS Rebinding protection mechanism.
23RISK
open ↗
Referência✓ VexDay Proof
TSEP 0.942 - 'copyright.php' Remote File Inclusion
CVE-2006-3993—webappsphp
PHP remote file inclusion vulnerability in copyright.php in Olaf Noehring The Search Engine Project (TSEP) 0.942 allows
23RISK
open ↗
Referência✓ VexDay Proof
ATutor 1.5.3.1 - 'links' Blind SQL Injection
CVE-2006-3996—webappsphp
SQL injection vulnerability in links/index.php in ATutor 1.5.3.1 and earlier allows remote authenticated users to execut
23RISK
open ↗
Referência✓ VexDay Proof
vbPortal 3.0.2 < 3.6.0 b1 - 'cookie' Remote Code Execution
CVE-2006-4004—webappsphp
Directory traversal vulnerability in index.php in vbPortal 3.0.2 through 3.6.0 Beta 1, when magic_quotes_gpc is disabled
23RISK
open ↗
Referência✓ VexDay Proof
PHP ZLink 0.3 - 'go.php' SQL Injection
CVE-2007-6578—webappsphp
SQL injection vulnerability in go.php in PHP ZLink 0.3 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência
CVE-2026-11882
CVE-2026-11882LOW
Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes
28RISK
open ↗
Referência
CVE-2026-11974
CVE-2026-11974HIGH
Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download
41RISK
open ↗
Referência
CVE-2026-16324
CVE-2026-16324MEDIUM
Metasoft 美特软件 MetaCRM upload.jsp unrestricted upload
33RISK
open ↗
Referência
CVE-2026-16248
CVE-2026-16248HIGH
Tenda AC10 httpd/netctrl AdvSetLanip fromAdvSetLanip stack-based overflow
41RISK
open ↗
Referência
CVE-2026-93548
CVE-2026-93548HIGH
FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation
41RISK
open ↗
← previouspage 821 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.