Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2020-8794
CVE-2020-8794—
OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for mult
60RISK
open ↗
Referência
CVE-2018-5981
CVE-2018-5981—
SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter.
23RISK
open ↗
Referência
CVE-2020-8813
CVE-2020-8813—
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a
60RISK
open ↗
Referência
CVE-2026-12987
CVE-2026-12987HIGH
Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration
41RISK
open ↗
Referência
CVE-2026-16200
CVE-2026-16200MEDIUM
zevorn rt-claw RPC swarm.c claw_tool_invoke authorization
33RISK
open ↗
Referência
CVE-2026-16199
CVE-2026-16199MEDIUM
nextlevelbuilder GoClaw credentialed_exec.go ExecTool.Execute improper authorization
33RISK
open ↗
Referência
CVE-2026-12906
CVE-2026-12906LOW
RTMKit Addons for Elementor < 2.0.9 - Contributor+ Private Post Title Disclosure
28RISK
open ↗
Referência
CVE-2026-14849
CVE-2026-14849LOW
Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files
28RISK
open ↗
Referência
CVE-2025-15665
CVE-2025-15665MEDIUM
BEAF < 4.7.1 - Admin+ Stored XSS via Widget Shortcode Field
33RISK
open ↗
Referência
CVE-2026-15479
CVE-2026-15479MEDIUM
H3C NX15 Administrator Password Modification Endpoint modify change_passwd password recovery
33RISK
open ↗
Referência✓ VexDay Proof
Mambo Component Ricette 1.0 - SQL Injection
CVE-2008-0841—webappsphp
SQL injection vulnerability in index.php in the Giorgio Nordo Ricette (com_ricette) 1.0 component for Joomla! and Mambo
23RISK
open ↗
Referência
CVE-2021-40378
CVE-2021-40378—
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. /cgi-bin/support/killp
28RISK
open ↗
Referência
CVE-2026-19089
CVE-2026-19089CRITICAL
Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload
63RISK
open ↗
Referência
CVE-2026-90504
CVE-2026-90504MEDIUM
vvbbnn00 WARP-Clash-API authorized missing authentication
33RISK
open ↗
Referência
CVE-2019-0211
CVE-2019-0211HIGHunder attack
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privilege
83RISK
open ↗
Referência
CVE-2021-21972
CVE-2021-21972CRITICALunder attackransomware
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor
100RISK
open ↗
Referência✓ VexDay Proof
Eurologon CMS - 'files.php' Arbitrary File Download
CVE-2007-6185—webappsphp
Directory traversal vulnerability in users/files.php in Eurologon CMS allows remote attackers to read arbitrary files vi
23RISK
open ↗
Referência✓ VexDay Proof
IP Reg 0.4 - Multiple SQL Injections
CVE-2008-4606—webappsphp
Multiple SQL injection vulnerabilities in IP Reg 0.4 and earlier allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
BlogMe PHP 1.1 - 'comments.php' SQL Injection
CVE-2008-2175—webappsphp
SQL injection vulnerability in comments.php in Gamma Scripts BlogMe PHP 1.1 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2026-108634
CVE-2026-108634MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission deleteBatch Endpoint
33RISK
open ↗
Referência✓ VexDay Proof
Cplinks 1.03 - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2008-2180—webappsphp
Multiple SQL injection vulnerabilities in cpLinks 1.03, when magic_quotes_gpc is disabled, allow remote attackers to exe
23RISK
open ↗
Referência
CVE-2018-14328
CVE-2018-14328—
Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensiti
28RISK
open ↗
Referência
CVE-2026-13703
CVE-2026-13703MEDIUM
SEO Redirection Plugin – 301 Redirect Manager < 9.19 - Subscriber+ Redirect Rule Disclosure
33RISK
open ↗
Referência
Webrun 3.6.0.42 - 'P_0' SQL Injection
CVE-2021-43650—webappsmultiple
WebRun 3.6.0.42 is vulnerable to SQL Injection via the P_0 parameter used to set the username during the login process.
23RISK
open ↗
Referência
CVE-2018-6892
CVE-2018-6892—
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RISK
open ↗
Referência
CVE-2018-6892
CVE-2018-6892—
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RISK
open ↗
Referência
CSZ CMS 1.2.9 - 'Multiple' Blind SQLi(Authenticated)
CVE-2021-43701—webappsphp
CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/articl
23RISK
open ↗
Referência
CVE-2018-6892
CVE-2018-6892—
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RISK
open ↗
Referência✓ VexDay Proof
Online Rental Property Script 4.5 - 'pid' SQL Injection
CVE-2008-2190—webappsphp
SQL injection vulnerability in index.php in Online Rent (aka Online Rental Property Script) 4.5 and earlier allows remot
23RISK
open ↗
Referência✓ VexDay Proof
wPortfolio 0.3 - Admin Password Changing
CVE-2008-5221—webappsphp
The account_save action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not
23RISK
open ↗
← previouspage 836 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.