Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,864cataloged exploits
40,957CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,439VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-82698
CVE-2026-82698MEDIUM
sambitraj Student-Management-System aca.sql default password
33RISK
open ↗
Referência
CVE-2016-5674
CVE-2016-5674—
__debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR Rea
60RISK
open ↗
Referência✓ VexDay Proof
Muratsoft Haber Portal 3.6 - 'tr' SQL Injection
CVE-2006-4641—webappsasp
SQL injection vulnerability in kategori.asp in Muratsoft Haber Portal 3.6 allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência
CVE-2026-12971
CVE-2026-12971LOW
LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature
28RISK
open ↗
Referência
CVE-2018-10809
CVE-2018-10809—
In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD)
23RISK
open ↗
Referência
CVE-2018-10933
CVE-2018-10933CRITICAL
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul
85RISK
open ↗
Referência
CVE-2022-24112
CVE-2022-24112CRITICALunder attack
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
100RISK
open ↗
Referência
Joomla! Component JMS Music 1.1.1 - SQL Injection
CVE-2018-6581—webappsphp
SQL Injection exists in the JMS Music 1.1.1 component for Joomla! via a search with the keyword, artist, or username par
23RISK
open ↗
Referência
CVE-2016-8655
CVE-2016-8655—
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cau
43RISK
open ↗
Referência
CVE-2017-16237
CVE-2017-16237—
In Vir.IT eXplorer Anti-Virus before 8.5.42, the driver file (VIAGLT64.SYS) contains an Arbitrary Write vulnerability be
23RISK
open ↗
Referência
CVE-2017-17579
CVE-2017-17579—
FS Freelancer Clone 1.0 has SQL Injection via the profile.php u parameter.
23RISK
open ↗
Referência
CVE-2022-24637
CVE-2022-24637—
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, wh
60RISK
open ↗
Referência
CVE-2022-24637
CVE-2022-24637—
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, wh
60RISK
open ↗
Referência
CVE-2026-16547
CVE-2026-16547MEDIUM
REST API Log < 1.7.1 - Unauthenticated Sensitive Log Data Disclosure via Download Endpoint
33RISK
open ↗
Referência
CVE-2017-8484
CVE-2017-8484—
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2,
23RISK
open ↗
Referência
CVE-2022-30525
CVE-2022-30525CRITICALunder attack
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat
100RISK
open ↗
Referência
CVE-2026-38636
CVE-2026-38636HIGH
An issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Servic
41RISK
open ↗
Referência✓ VexDay Proof
Web3news 0.95 - 'PHPSECURITYADMIN_PATH' Remote File Inclusion
CVE-2006-4452—webappsphp
PHP remote file inclusion vulnerability in security/include/_class.security.php in Web3news 0.95 and earlier, when regis
23RISK
open ↗
Referência
CVE-2017-17608
CVE-2017-17608—
Child Care Script 1.0 has SQL Injection via the /list city parameter.
23RISK
open ↗
Referência
CVE-2026-38638
CVE-2026-38638HIGH
An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Servic
41RISK
open ↗
Referência
CVE-2026-81836
CVE-2026-81836MEDIUM
RooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission
33RISK
open ↗
Referência✓ VexDay Proof
Interact 2.2 - 'CONFIG[base_path]' Remote File Inclusion
CVE-2006-4448—webappsphp
Multiple PHP remote file inclusion vulnerabilities in interact 2.2, when register_globals is enabled, allow remote attac
23RISK
open ↗
Referência
CVE-2017-17613
CVE-2017-17613—
Freelance Website Script 2.0.6 has SQL Injection via the jobdetails.php pr_id parameter or the searchbycat_list.php cati
23RISK
open ↗
Referência
CVE-2017-17614
CVE-2017-17614—
Food Order Script 1.0 has SQL Injection via the /list city parameter.
23RISK
open ↗
Referência
CVE-2017-17616
CVE-2017-17616—
Event Search Script 1.0 has SQL Injection via the /event-list city parameter.
23RISK
open ↗
Referência✓ VexDay Proof
InoutMailingListManager 3.1 - Remote Command Execution
CVE-2007-2004—webappsphp
Multiple SQL injection vulnerabilities in InoutMailingListManager 3.1 and earlier allow remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component com_yanc 1.4 Beta - 'id' SQL Injection
CVE-2007-2792—webappsphp
SQL injection vulnerability in the Yet another Newsletter Component (aka YaNC or com_yanc) component before 1.5 beta 3 f
23RISK
open ↗
Referência
CVE-2026-13736
CVE-2026-13736MEDIUM
NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API
33RISK
open ↗
Referência
CVE-2026-15253
CVE-2026-15253MEDIUM
Easy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment Title
33RISK
open ↗
Referência
CVE-2026-14568
CVE-2026-14568MEDIUM
WP User Frontend < 4.3.8 - Unauthenticated Author-less Attachment Deletion
33RISK
open ↗
← previouspage 823 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.