Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,864cataloged exploits
40,957CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,439VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-12203
CVE-2026-12203MEDIUM
HKUDS AI-Trader Research Export agents.csv information disclosure
33RISK
open ↗
Referência
CVE-2026-12197
CVE-2026-12197HIGH
Ruijie EG105G-P JSON-RPC Diagnose Endpoint diagnose nslookup command injection
41RISK
open ↗
Referência
CVE-2026-12189
CVE-2026-12189MEDIUM
Moovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url scheme
33RISK
open ↗
Referência
CVE-2026-12187
CVE-2026-12187HIGH
GL.iNet GL-MT3000 Online Firmware Upgrade one_click_upgrade command injection
41RISK
open ↗
Referência
CVE-2026-12186
CVE-2026-12186HIGH
GL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injection
41RISK
open ↗
Referência
CVE-2014-8654
CVE-2014-8654—
Multiple cross-site request forgery (CSRF) vulnerabilities in Compal Broadband Networks (CBN) CH6640E and CG6640E Wirele
23RISK
open ↗
Referência
CVE-2017-17721
CVE-2017-17721—
CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, ass
23RISK
open ↗
Referência
CVE-2015-7567
CVE-2015-7567—
SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passw
23RISK
open ↗
Referência
CVE-2019-9082
CVE-2019-9082HIGHunder attack
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public/
100RISK
open ↗
Referência
CVE-2019-9162
CVE-2019-9162—
In the Linux kernel before 4.20.12, net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP NAT module has insufficient
23RISK
open ↗
Referência
CVE-2026-110983
CVE-2026-110983MEDIUM
WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
33RISK
open ↗
Referência
CVE-2026-110505
CVE-2026-110505MEDIUM
Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass
33RISK
open ↗
Referência
CVE-2022-35513
CVE-2022-35513—
The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage.
23RISK
open ↗
Referência
CVE-2017-0092
CVE-2017-0092—
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers
28RISK
open ↗
Referência
CVE-2017-6550
CVE-2017-6550—
Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) allow remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2020-0674
CVE-2020-0674HIGHunder attack
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet
93RISK
open ↗
Referência✓ VexDay Proof
PHP 5.2.1 with PECL PHPDOC - Local Buffer Overflow
CVE-2007-1709—localwindows
Buffer overflow in the confirm_phpdoc_compiled function in the phpDOC extension (PECL phpDOC) in PHP 5.2.1 allows contex
23RISK
open ↗
Referência
CVE-2026-115302
CVE-2026-115302MEDIUM
Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion
33RISK
open ↗
Referência
CVE-2026-115301
CVE-2026-115301HIGH
Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block
41RISK
open ↗
Referência
CVE-2026-115300
CVE-2026-115300MEDIUM
Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF
33RISK
open ↗
Referência
CVE-2026-115299
CVE-2026-115299MEDIUM
Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF
33RISK
open ↗
Referência
Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path
CVE-2022-35899—localwindows
There is an unquoted service path in ASUSTeK Aura Ready Game SDK service (GameSDK.exe) 1.0.0.4. This might allow a local
23RISK
open ↗
Referência
CVE-2016-0846
CVE-2016-0846—
libs/binder/IMemory.cpp in the IMemory Native Interface in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.
23RISK
open ↗
Referência
CVE-2026-115282
CVE-2026-115282MEDIUM
Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure
33RISK
open ↗
Referência
CVE-2026-118578
CVE-2026-118578MEDIUM
maotoumao MusicFreeDesktop Request Forwarder information disclosure
33RISK
open ↗
Referência
CVE-2026-118577
CVE-2026-118577MEDIUM
maotoumao MusicFreeDesktop Request Forwarder server-side request forgery
33RISK
open ↗
Referência
CVE-2026-115281
CVE-2026-115281MEDIUM
Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute
33RISK
open ↗
Referência
CVE-2026-115224
CVE-2026-115224MEDIUM
Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding
33RISK
open ↗
Referência
CVE-2026-113813
CVE-2026-113813MEDIUM
PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure
33RISK
open ↗
Referência
CVE-2026-113494
CVE-2026-113494LOW
GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode
28RISK
open ↗
← previouspage 825 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.