Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-86162
CVE-2026-86162MEDIUM
SourceCodester Online Voting System ajax.php login sql injection
33RISK
open ↗
Referência
CVE-2026-86161
CVE-2026-86161MEDIUM
SourceCodester Online Voting System ajax.php delete_category sql injection
33RISK
open ↗
Referência
CVE-2026-86160
CVE-2026-86160MEDIUM
SourceCodester Online Voting System ajax.php delete_voting sql injection
33RISK
open ↗
Referência
CVE-2022-36446
CVE-2022-36446—
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.
60RISK
open ↗
Referência
CVE-2020-6010
CVE-2020-6010—
LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection
50RISK
open ↗
Referência
CVE-2020-7246
CVE-2020-7246—
A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code
60RISK
open ↗
Referência
CVE-2017-9430
CVE-2017-9430—
Stack-based buffer overflow in dnstracer through 1.9 allows attackers to cause a denial of service (application crash) o
28RISK
open ↗
Referência
CVE-2026-103117
CVE-2026-103117MEDIUM
OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection
33RISK
open ↗
Referência
CVE-2026-103115
CVE-2026-103115MEDIUM
OS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injection
33RISK
open ↗
Referência
CVE-2026-103114
CVE-2026-103114MEDIUM
OS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injection
33RISK
open ↗
Referência
CVE-2026-103113
CVE-2026-103113MEDIUM
OS4ED openSIS-Classic General Information Tab Student.php save action sql injection
33RISK
open ↗
Referência
CVE-2026-97316
CVE-2026-97316MEDIUM
Broken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated SSRF via Redirect Bypass
33RISK
open ↗
Referência
CVE-2026-96886
CVE-2026-96886MEDIUM
Course Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV Export
33RISK
open ↗
Referência✓ VexDay Proof
Prozilla Webring Website Script - 'category.php?cat' SQL Injection
CVE-2007-4362—webappsphp
SQL injection vulnerability in category.php in Prozilla Webring allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
IBM Rational ClearQuest - Web Authentication Bypass / SQL Injection
CVE-2007-4368—webappscgi
SQL injection vulnerability in /main in IBM Rational ClearQuest (CQ) Web 7.0.0.0-IFIX02 and 7.0.0.1 allows remote attack
23RISK
open ↗
Referência
CVE-2026-86828
CVE-2026-86828MEDIUM
BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback
33RISK
open ↗
Referência
CVE-2026-86816
CVE-2026-86816MEDIUM
WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API
33RISK
open ↗
Referência
CVE-2026-105621
CVE-2026-105621MEDIUM
jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization
33RISK
open ↗
Referência
CVE-2026-105611
CVE-2026-105611MEDIUM
chillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorization
33RISK
open ↗
Referência
CVE-2026-105610
CVE-2026-105610MEDIUM
chillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization
33RISK
open ↗
Referência
CVE-2020-8776
CVE-2020-8776—
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a
23RISK
open ↗
Referência
CVE-2018-20250
CVE-2018-20250HIGHunder attackransomware
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RISK
open ↗
Referência
CVE-2018-20250
CVE-2018-20250HIGHunder attackransomware
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RISK
open ↗
Referência
PHPKB Multi-Language 9 - 'image-upload.php' Authenticated Remote Code Execution
CVE-2020-10386—webappsphp
admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Exe
28RISK
open ↗
Referência
CVE-2008-0722
CVE-2008-0722—
Cross-site scripting (XSS) vulnerability in index.php in Pagetool 1.0.7 allows remote attackers to inject arbitrary web
23RISK
open ↗
Referência
CVE-2008-0729
CVE-2008-0729—
Mobile Safari on Apple iPhone 1.1.2 and 1.1.3 allows remote attackers to cause a denial of service (memory exhaustion an
23RISK
open ↗
Referência✓ VexDay Proof
Omnistar Article Manager Software - 'article.php' SQL Injection
CVE-2007-4952—webappsphp
SQL injection vulnerability in article.php in OmniStar Article Manager allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
PHPKB Multi-Language 9 - Authenticated Directory Traversal
CVE-2020-10387—webappsphp
Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files
23RISK
open ↗
Referência
CVE-2020-10385
CVE-2020-10385—
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.
23RISK
open ↗
Referência
CVE-2020-9375
CVE-2020-9375—
TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a
28RISK
open ↗
← previouspage 833 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.