Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,865cataloged exploits
40,957CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,440VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-10522
Simple User Registration <= 6.9 - Unauthenticated Privilege Escalation to Administrator
48RISK
open ↗Referência
CVE-2026-14325
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting
28RISK
open ↗Referência
CVE-2026-77391
SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP cross-site request forgery
33RISK
open ↗Referência
CVE-2026-82078
PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector
100RISK
open ↗Referência
CVE-2021-42840
SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumsta
50RISK
open ↗Referência★ 8
Unitree G1 RCE PoC & Scripts (CVE-2026-76639 / CVE-2026-76640) technical details at boschko.ca/g1-ble-rce/
Unitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal
41RISK
open ↗Referência✓ VexDay Proof
PostNuke 0.763 - 'PNSV lang' Remote Code Execution
Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and exec
23RISK
open ↗Referência★ 26
CVE-2026-72844 : Example of proving "0 = 1" using a vulnerability in the Lean 4 kernel.
Lean 4 Kernel Type Checking Bypass via Mismatched Structure Projections
33RISK
open ↗Referência
CVE-2026-78161
warmcat libwebsockets LECP CBOR Recording lecp.c report_raw_cbor out-of-bounds write
33RISK
open ↗Referência
CVE-2026-78115
SourceCodester Class and Exam Timetabling System User Account Update edit_user_account.php improper authorization
33RISK
open ↗Referência
CVE-2026-10053
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
41RISK
open ↗Referência
CVE-2026-76995
SourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted upload
33RISK
open ↗Referência
CVE-2026-76576
yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal
33RISK
open ↗Referência
CVE-2017-8636
Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Serve
45RISK
open ↗Referência
CVE-2017-8636
Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Serve
45RISK
open ↗Referência
CVE-2026-10270
D-Link DI-7001 MINI API httpd_debug.asp sprintf stack-based overflow
41RISK
open ↗Referência
CVE-2017-17575
FS Groupon Clone 1.0 has SQL Injection via the item_details.php id parameter or the vendor_details.php id parameter.
23RISK
open ↗Referência
CVE-2018-18800
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=[SQL], index.php?p=
23RISK
open ↗Referência
CVE-2017-17579
FS Freelancer Clone 1.0 has SQL Injection via the profile.php u parameter.
23RISK
open ↗Referência
CVE-2019-19726
OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be
38RISK
open ↗Referência
CVE-2019-19781
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th
100RISK
open ↗Referência
CVE-2019-19781
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.