Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,864cataloged exploits
40,957CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,439VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-51879
CVE-2026-51879CRITICAL
deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bo
48RISK
open ↗
Referência
CVE-2026-37604
CVE-2026-37604MEDIUM
pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/
33RISK
open ↗
Referência
CVE-2026-91014
CVE-2026-91014HIGH
Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint
41RISK
open ↗
Referência
CVE-2018-5977
CVE-2018-5977—
SQL Injection exists in Affiligator Affiliate Webshop Management System 2.1.0 via a search/?q=&price_type=range&price= r
23RISK
open ↗
Referência
CVE-2019-6340
CVE-2019-6340HIGHunder attack
Drupal core - Highly critical - Remote Code Execution
100RISK
open ↗
Referência
CVE-2023-33580
CVE-2023-33580—
Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in the "Admin Name" f
23RISK
open ↗
Referência✓ VexDay Proof
IntelliTamper 2.07 - '.map' Local Arbitrary Code Execution (1)
CVE-2006-2494—localwindows
Stack-based buffer overflow in IntelliTamper 2.07 allows remote attackers to execute arbitrary code via a crafted .map f
23RISK
open ↗
Referência
CVE-2026-85397
CVE-2026-85397MEDIUM
code-projects Hospital Information System addReq.php findBySearch sql injection
33RISK
open ↗
Referência
CVE-2025-15485
CVE-2025-15485HIGH
Auto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call
41RISK
open ↗
Referência
CVE-2026-92466
CVE-2026-92466HIGH
microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking
41RISK
open ↗
Referência
CVE-2026-92460
CVE-2026-92460HIGH
yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing
41RISK
open ↗
Referência
CVE-2026-14562
CVE-2026-14562MEDIUM
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure
33RISK
open ↗
Referência
CVE-2026-14560
CVE-2026-14560CRITICAL
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload
48RISK
open ↗
Referência
CVE-2026-14559
CVE-2026-14559CRITICAL
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover
48RISK
open ↗
Referência
CVE-2025-15481
CVE-2025-15481MEDIUM
Notification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure
33RISK
open ↗
Referência
CVE-2024-3773
CVE-2024-3773MEDIUM
LiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode
33RISK
open ↗
Referência✓ VexDay Proof
Surgemail 38k - 'Search' Remote Buffer Overflow
CVE-2007-4377—remotewindows
Stack-based buffer overflow in the IMAP service in SurgeMail 38k allows remote authenticated users to execute arbitrary
23RISK
open ↗
Referência
CVE-2019-8923
CVE-2019-8923—
XAMPP through 5.6.8 and previous allows SQL injection via the cds-fpdf.php jahr parameter. NOTE: This product is discont
23RISK
open ↗
Referência
CVE-2026-81934
CVE-2026-81934HIGH
Redis TLS pending-data list use-after-free
41RISK
open ↗
Referência
CVE-2026-16569
CVE-2026-16569MEDIUM
ShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update
33RISK
open ↗
Referência
CVE-2026-13392
CVE-2026-13392HIGH
ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)
41RISK
open ↗
Referência
CVE-2026-12720
CVE-2026-12720HIGH
Kirki < 6.0.13 - Unauthenticated PHP Object Injection
41RISK
open ↗
Referência
CVE-2020-0618
CVE-2020-0618CRITICALunder attackransomware
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page
100RISK
open ↗
Referência
CVE-2020-0618
CVE-2020-0618CRITICALunder attackransomware
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page
100RISK
open ↗
Referência✓ VexDay Proof
DL PayCart 1.01 - 'viewitem.php?ItemID' Blind SQL Injection
CVE-2007-4604—webappsphp
SQL injection vulnerability in viewitem.php in DL PayCart 1.01 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2026-15381
CVE-2026-15381LOW
WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter
28RISK
open ↗
Referência✓ VexDay Proof
Epistemon 1.0 - 'common.php?inc_path' Remote File Inclusion
CVE-2007-0701—webappsphp
PHP remote file inclusion vulnerability in inc/common.inc.php in Epistemon 1.0 allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
PHPNuke-Clan 4.2.0 - 'mvcw_conver.php' Remote File Inclusion
CVE-2007-4606—webappsphp
PHP remote file inclusion vulnerability in convert/mvcw_conver.php in the Virtual War (VWar) module for PHPNuke-Clan (PN
23RISK
open ↗
Referência
CVE-2018-12094
CVE-2018-12094—
Cross-site scripting (XSS) vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arb
23RISK
open ↗
Referência
CVE-2018-7312
CVE-2018-7312—
SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter.
23RISK
open ↗
← previouspage 824 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.