Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,868cataloged exploits
40,958CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,443VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2019-0841
CVE-2019-0841HIGHunder attackransomware
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard li
98RISK
open ↗
Referência
CVE-2021-48013
CVE-2021-48013HIGH
Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload
41RISK
open ↗
Referência
CVE-2019-25778
CVE-2019-25778HIGH
SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter
41RISK
open ↗
Referência
CVE-2026-15540
CVE-2026-15540MEDIUM
SourceCodester Online Book Store System Administrative index.php php file inclusion
33RISK
open ↗
Referência
CVE-2026-86232
CVE-2026-86232MEDIUM
itsourcecode Sales and Inventory System sup_del.php sql injection
33RISK
open ↗
Referência
CVE-2026-107079
CVE-2026-107079MEDIUM
An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parame
33RISK
open ↗
Referência
CVE-2026-16255
CVE-2026-16255MEDIUM
Incorrect Authorization in GitLab
33RISK
open ↗
Referência
CVE-2026-103515
CVE-2026-103515LOW
Incorrect Authorization in GitLab
28RISK
open ↗
Referência✓ VexDay Proof
vuBB 0.2 Final - 'cookie' SQL Injection
CVE-2006-0962—webappsphp
SQL injection vulnerability in vuBB 0.2 allows remote attackers to execute arbitrary SQL commands via the pass parameter
23RISK
open ↗
Referência✓ VexDay Proof
EasyCalendar 4.0tr - Multiple Vulnerabilities
CVE-2008-1345—webappsphp
Cross-site scripting (XSS) vulnerability in plugins/calendar/calendar_backend.php in MyioSoft EasyCalendar 4.0tr and ear
23RISK
open ↗
Referência
CVE-2026-114374
CVE-2026-114374MEDIUM
leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery
33RISK
open ↗
Referência
CVE-2026-15699
CVE-2026-15699MEDIUM
spencermountain compromise Public Root API extend.js nlp.extend prototype pollution
33RISK
open ↗
Referência
CVE-2026-58477
CVE-2026-58477HIGH
Sustainable Irrigation Platform 5.2.16 Mass Assignment via HTTP Parameters
41RISK
open ↗
Referência
CVE-2026-15678
CVE-2026-15678MEDIUM
code-projects Online Job Portal DetailJob.php cross site scripting
33RISK
open ↗
Referência
CVE-2021-36260
CVE-2021-36260CRITICALunder attack
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,
100RISK
open ↗
Referência
CVE-2018-15687
CVE-2018-15687HIGH
systemd: chown_one() can dereference symlinks
41RISK
open ↗
Referência
CVE-2026-81424
CVE-2026-81424MEDIUM
Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR
33RISK
open ↗
Referência
CVE-2018-15877
CVE-2018-15877—
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell meta
60RISK
open ↗
Referência
CVE-2021-47977
CVE-2021-47977HIGH
WordPress Anti-Malware Security Bruteforce Firewall <= 4.20.72 Directory Traversal
41RISK
open ↗
Referência
CVE-2026-108631
CVE-2026-108631MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/delete
33RISK
open ↗
Referência
CVE-2026-8786
CVE-2026-8786MEDIUM
Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization
33RISK
open ↗
Referência
CVE-2026-8784
CVE-2026-8784MEDIUM
npitre cramfs-tools cramfsck.c change_file_status symlink
33RISK
open ↗
Referência
CVE-2026-8783
CVE-2026-8783MEDIUM
omec-project amf dispatcher.go UERadioCapabilityCheckResponse null pointer dereference
33RISK
open ↗
Referência
CVE-2026-8781
CVE-2026-8781MEDIUM
omec-project amf handler.go RANConfiguration null pointer dereference
33RISK
open ↗
Referência
CVE-2021-36711
CVE-2021-36711—
WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.
28RISK
open ↗
Referência✓ VexDay Proof
Apple QuickTime 7.2/7.3 (OSX/Windows) - RSTP Response Universal
CVE-2002-0252—remotemultiple
Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a respon
28RISK
open ↗
Referência
CVE-2026-45233
CVE-2026-45233HIGH
HTMLy CMS 3.1.1 Path Traversal via oldfile Parameter in Autosave
41RISK
open ↗
Referência
CVE-2026-12807
CVE-2026-12807MEDIUM
Edimax BR-6478AC V2 POST Request setWAN command injection
33RISK
open ↗
Referência
CVE-2019-25763
CVE-2019-25763CRITICAL
WordPress Ultimate Addons for Beaver Builder 1.2.4.1 Authentication Bypass
48RISK
open ↗
Referência
CVE-2018-2892
CVE-2018-2892—
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Availability Suite Service).
23RISK
open ↗
← previouspage 831 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.