Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,865cataloged exploits
40,957CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,440VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2018-25325
CVE-2018-25325HIGH
Woocommerce CSV Importer 3.3.6 Path Traversal File Deletion
41RISK
open ↗
Referência
CVE-2018-25322
CVE-2018-25322HIGH
Allok Fast AVI MPEG Splitter 1.2 Stack Based Buffer Overflow
41RISK
open ↗
Referência
CVE-2018-25321
CVE-2018-25321MEDIUM
TP-Link TL-WR720N CSRF via Administrative Interfaces (firmware V1_130719)
33RISK
open ↗
Referência
CVE-2018-25320
CVE-2018-25320CRITICAL
ACL Analytics 11.x - 13.0.0.579 Arbitrary Code Execution
48RISK
open ↗
Referência
CVE-2018-25319
CVE-2018-25319HIGH
Redaxo CMS Addon MyEvents 2.2.1 SQL Injection via event_add.php
41RISK
open ↗
Referência
CVE-2026-8753
CVE-2026-8753MEDIUM
kalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection
33RISK
open ↗
Referência
CVE-2026-8752
CVE-2026-8752MEDIUM
h2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control
33RISK
open ↗
Referência
CVE-2026-8751
CVE-2026-8751MEDIUM
h2oai h2o-3 JAR Model.java importBinaryModel deserialization
33RISK
open ↗
Referência
CVE-2026-8750
CVE-2026-8750MEDIUM
h2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure
33RISK
open ↗
Referência
CVE-2026-8747
CVE-2026-8747MEDIUM
Z-BlogPHP Commend Approval c_system_event.php CheckComment improper authorization
33RISK
open ↗
Referência
CVE-2026-8746
CVE-2026-8746MEDIUM
Open5GS NRF nghttp2-server.c discover_handler use after free
33RISK
open ↗
Referência
CVE-2017-6097
CVE-2017-6097—
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/camp
23RISK
open ↗
Referência
CVE-2026-8745
CVE-2026-8745MEDIUM
Open5GS AUSF nausf-handler.c ogs_timer_add denial of service
33RISK
open ↗
Referência
CVE-2026-8744
CVE-2026-8744MEDIUM
Open5GS NRF context.c ogs_sbi_nf_service_add denial of service
33RISK
open ↗
Referência
CVE-2026-8743
CVE-2026-8743MEDIUM
Open5GS AMF/MME context.c ran_ue_find_by_amf_ue_ngap_id improper authorization
33RISK
open ↗
Referência
CVE-2026-8741
CVE-2026-8741LOW
EMQX QoS 2 PUBLISH Packet emqx_persistent_session_ds.erl race condition
28RISK
open ↗
Referência
CVE-2026-8740
CVE-2026-8740MEDIUM
Sanluan PublicCMS templateResult API TemplateResultDirective.java execute special elements used in a template engine
33RISK
open ↗
Referência
CVE-2026-8739
CVE-2026-8739MEDIUM
Sanluan PublicCMS SafeConfigComponent.java getSignKey hard-coded key
33RISK
open ↗
Referência
CVE-2017-8462
CVE-2017-8462—
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,
23RISK
open ↗
Referência
CVE-2011-5283
CVE-2011-5283—
Cross-site scripting (XSS) vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Expre
23RISK
open ↗
Referência
CVE-2011-5283
CVE-2011-5283—
Cross-site scripting (XSS) vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Expre
23RISK
open ↗
Referência
CVE-2014-8687
CVE-2014-8687—
Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root
50RISK
open ↗
Referência
CVE-2026-34022
CVE-2026-34022HIGH
Weak custom cryptography and hard-coded keys in Wertheim SafeController 65000 allow traffic decryption
41RISK
open ↗
Referência
CVE-2018-18797
CVE-2018-18797—
School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.
23RISK
open ↗
Referência
CVE-2018-18798
CVE-2018-18798—
Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.ph
23RISK
open ↗
Referência
CVE-2018-18799
CVE-2018-18799—
School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos.
23RISK
open ↗
Referência
CVE-2026-18781
CVE-2026-18781HIGH
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass
41RISK
open ↗
Referência
CVE-2026-14601
CVE-2026-14601MEDIUM
Link Whisper < 0.9.7 - Editor+ SQL Injection via domain Parameter
33RISK
open ↗
Referência
CVE-2026-76988
CVE-2026-76988MEDIUM
liftoff-sr CIPster ForwardOpen cipconnectionmanager.cc forward_open out-of-bounds
33RISK
open ↗
Referência
CVE-2026-76987
CVE-2026-76987MEDIUM
liftoff-sr CIPster Generic Attribute Logic ciptypes.h SetAttrData memory corruption
33RISK
open ↗
← previouspage 827 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.