Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,861cataloged exploits
40,956CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,436VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2006-5190
CVE-2006-5190—
Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers t
23RISK
open ↗
Referência
CVE-2026-14941
CVE-2026-14941MEDIUM
Customer Reviews for WooCommerce < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions
33RISK
open ↗
Referência
CVE-2017-7358
CVE-2017-7358—
In LightDM through 1.22.0, a directory traversal issue in debian/guest-account.sh allows local attackers to own arbitrar
23RISK
open ↗
Referência
CVE-2006-5190
CVE-2006-5190—
Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers t
23RISK
open ↗
Referência
CVE-2006-5190
CVE-2006-5190—
Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers t
23RISK
open ↗
Referência
CVE-2018-15608
CVE-2018-15608—
Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the "AD Delegation" "Help Desk Technicians" screen.
23RISK
open ↗
Referência
CVE-2026-10514
CVE-2026-10514MEDIUM
1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting
33RISK
open ↗
Referência
CVE-2026-111027
CVE-2026-111027MEDIUM
Welcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' Parameter
33RISK
open ↗
Referência
CVE-2017-15989
CVE-2017-15989—
Online Exam Test Application allows SQL Injection via the resources.php sort parameter in a category action.
23RISK
open ↗
Referência
CVE-2026-76640
CVE-2026-76640HIGH
Unitree G1 EDU 1.5.2 BLE GATT RCE via WiFi Provisioning Stack
41RISK
open ↗
Referência
CVE-2017-15993
CVE-2017-15993—
Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter.
23RISK
open ↗
Referência
CVE-2017-6090
CVE-2017-6090—
Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authentica
60RISK
open ↗
Referência
CVE-2026-24061
CVE-2026-24061CRITICALunder attack
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISK
open ↗
Referência
CVE-2026-10661
CVE-2026-10661MEDIUM
ahujasid blender-mcp server.py open injection
33RISK
open ↗
Referência
CVE-2026-82908
CVE-2026-82908CRITICAL
MSI Dragon Center MMIO Write Path NTIOLib_X64.sys MmioWritePath integer overflow
48RISK
open ↗
Referência
CVE-2017-16777
CVE-2017-16777—
If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a loc
23RISK
open ↗
Referência
CVE-2026-77701
CVE-2026-77701MEDIUM
WCFM Marketplace < 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders
33RISK
open ↗
Referência✓ VexDay Proof
WGCC 0.5.6b - 'quiz.php' SQL Injection
CVE-2006-5514—webappsphp
SQL injection vulnerability in quiz.php in Web Group Communication Center (WGCC) 0.5.6b and earlier allows remote attack
23RISK
open ↗
Referência
CVE-2026-111021
CVE-2026-111021HIGH
Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter
41RISK
open ↗
Referência
CVE-2026-78115
CVE-2026-78115MEDIUM
SourceCodester Class and Exam Timetabling System User Account Update edit_user_account.php improper authorization
33RISK
open ↗
Referência
CVE-2026-76995
CVE-2026-76995MEDIUM
SourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted upload
33RISK
open ↗
Referência
CVE-2026-76993
CVE-2026-76993LOW
GreyDGL PentestGPT Web-Page Crawling injection
28RISK
open ↗
Referência
CVE-2021-42840
CVE-2021-42840—
SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumsta
50RISK
open ↗
Referência
CVE-2026-82078
CVE-2026-82078CRITICALunder attack
PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector
100RISK
open ↗
Referência
CVE-2026-78161
CVE-2026-78161MEDIUM
warmcat libwebsockets LECP CBOR Recording lecp.c report_raw_cbor out-of-bounds write
33RISK
open ↗
Referência
CVE-2026-76583
CVE-2026-76583MEDIUM
TRENDnet TV-IP751WIC alphapd set_time.cgi command injection
33RISK
open ↗
Referência
CVE-2026-76576
CVE-2026-76576MEDIUM
yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal
33RISK
open ↗
Referência✓ VexDay Proof
PostNuke 0.763 - 'PNSV lang' Remote Code Execution
CVE-2006-5733—webappsphp
Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and exec
23RISK
open ↗
Referência
CVE-2026-10522
CVE-2026-10522CRITICAL
Simple User Registration <= 6.9 - Unauthenticated Privilege Escalation to Administrator
48RISK
open ↗
Referência
CVE-2026-10053
CVE-2026-10053HIGH
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
41RISK
open ↗
← previouspage 822 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.