Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,865cataloged exploits
40,957CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,440VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-107270
Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints
41RISK
open ↗Referência
CVE-2026-107181
Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
41RISK
open ↗Referência
CVE-2018-20250
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RISK
open ↗Referência
CVE-2018-20250
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RISK
open ↗Referência
PHPKB Multi-Language 9 - 'image-upload.php' Authenticated Remote Code Execution
admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Exe
28RISK
open ↗Referência
CVE-2008-0722
Cross-site scripting (XSS) vulnerability in index.php in Pagetool 1.0.7 allows remote attackers to inject arbitrary web
23RISK
open ↗Referência
CVE-2008-0729
Mobile Safari on Apple iPhone 1.1.2 and 1.1.3 allows remote attackers to cause a denial of service (memory exhaustion an
23RISK
open ↗Referência✓ VexDay Proof
Omnistar Article Manager Software - 'article.php' SQL Injection
SQL injection vulnerability in article.php in OmniStar Article Manager allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência
PHPKB Multi-Language 9 - Authenticated Directory Traversal
Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files
23RISK
open ↗Referência
CVE-2020-10385
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.
23RISK
open ↗Referência
CVE-2020-9375
TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a
28RISK
open ↗Referência
CVE-2020-14864
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ins
100RISK
open ↗Referência✓ VexDay Proof
ProfileCMS 1.0 - Arbitrary File Upload
Unrestricted file upload vulnerability in the profiles script in ProfileCMS 1.0 allows remote attackers to upload and ex
23RISK
open ↗Referência
CVE-2026-103231
AdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mysqli_query sql injection
33RISK
open ↗Referência
CVE-2026-85187
itsourcecode Online Medicine Delivery System Order Status Update controller.php pupdate sql injection
33RISK
open ↗Referência
CVE-2026-85040
ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection
33RISK
open ↗Referência
CVE-2026-19206
MZ Automation libiec61850 ASDU Element sv_subscriber.c SVReceiver_stopThreadless heap-based overflow
33RISK
open ↗Referência✓ VexDay Proof
Portail PHP 1.7 - 'chemin' Remote File Inclusion
PHP remote file inclusion vulnerability in mod_membre/inscription.php in PortailPHP 1.7 allows remote attackers to execu
23RISK
open ↗Referência
CVE-2018-0296
A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remo
100RISK
open ↗Referência✓ VexDay Proof
WMNews 0.2a - 'base_datapath' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in WMNews 0.2a and earlier allows remote attackers to execute arbit
23RISK
open ↗Referência
CVE-2018-0706
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticate
50RISK
open ↗Referência✓ VexDay Proof
Vigile CMS 1.4 - Multiple Vulnerabilities
Cross-site request forgery (CSRF) vulnerability in index.php in VigileCMS 1.4 allows remote attackers to change the admi
23RISK
open ↗Referência✓ VexDay Proof
phpArcadeScript 3.0RC2 - 'userid' SQL Injection
SQL injection vulnerability in index.php in phpArcadeScript 1.0 through 3.0 RC2 allows remote attackers to execute arbit
23RISK
open ↗Referência
CVE-2026-67599
ClearOS 7.9 OS Command Injection via Log Viewer filter parameter
41RISK
open ↗Referência
CVE-2018-1000049
Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner
60RISK
open ↗Referência
CVE-2018-1000049
Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner
60RISK
open ↗Referência✓ VexDay Proof
TualBLOG 1.0 - 'icerikno' SQL Injection
Multiple SQL injection vulnerabilities in icerik.asp in TualBLOG 1.0 allow remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência
CVE-2020-23972
In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating
50RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.