Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-120190
PostyBirb Plus Submission Description Editor DescriptionInput.tsx cross site scripting
33RISK
open ↗Referência
CVE-2026-94361
PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback
33RISK
open ↗Referência✓ VexDay Proof
Quicksilver Forums 1.2.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in lib/activeutil.php in Quicksilver Forums (QSF) 1.2.1 and earlier allows remot
23RISK
open ↗Referência✓ VexDay Proof
Project Based Calendaring System (PBCS) 0.7.1 - Multiple Vulnerabilities
Unrestricted file upload vulnerability in src/yopy_upload.php in Project-Based Calendaring System (PBCS) 0.7.1 allows re
23RISK
open ↗Referência✓ VexDay Proof
Content Management System for Phprojekt 0.6.1 - File Disclosure
Directory traversal vulnerability in cm/graphie.php in Content Management System 0.6.1 for Phprojekt allows remote attac
23RISK
open ↗Referência✓ VexDay Proof
WebStudio eCatalogue - Blind SQL Injection
SQL injection vulnerability in index.php in WebStudio eCatalogue allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗Referência✓ VexDay Proof
PG Real Estate - Authentication Bypass
SQL injection vulnerability in admin/index.php in PG Real Estate Solution allows remote attackers to execute arbitrary S
23RISK
open ↗Referência
CVE-2026-93532
gedelumbung HospitalManagement Password Change password.php simpan improper authentication
33RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke 7.9 - 'Encyclopedia' SQL Injection
Incomplete blacklist vulnerability in mainfile.php in PHP-Nuke 7.9 and earlier allows remote attackers to conduct SQL in
23RISK
open ↗Referência
Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE
ingress-nginx controller - configuration injection via unsanitized auth-url annotation
68RISK
open ↗Referência
CVE-2026-16653
boazsegev facil.io Public Folder http.c http_sendfile2 path traversal
33RISK
open ↗Referência
CVE-2021-24145
Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE
60RISK
open ↗Referência
CVE-2026-88994
All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes
33RISK
open ↗Referência
CVE-2026-115277
WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter
33RISK
open ↗Referência✓ VexDay Proof
OTSCMS 2.1.3 - Multiple Remote File Inclusions
PHP remote file inclusion vulnerability in OTSCMS/OTSCMS.php in Open Tibia Server Content Management System (OTSCMS) 2.0
23RISK
open ↗Referência✓ VexDay Proof
QuickUpCMS - Multiple SQL Injections Vulnerabilities
Multiple SQL injection vulnerabilities in Concepts & Solutions QuickUpCMS allow remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
TeamCal Pro 2.8.001 - 'app_root' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/footer.html.inc.php in TeamCal Pro 2.8.001 and earlier allows remote
23RISK
open ↗Referência
CVE-2026-87965
Easy Appointments < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token
33RISK
open ↗Referência
CVE-2026-108598
Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates
48RISK
open ↗Referência
CVE-2026-119739
Amlogic DroidLogic SubTitleService Out-of-Bounds Write via VobSub SET_CONTR
33RISK
open ↗Referência
CVE-2018-12602
A CSRF vulnerability exists in LFCMS 3.7.0: users can be added arbitrarily.
23RISK
open ↗Referência✓ VexDay Proof
BolinOS 4.5.5 - 'gBRootPath' Remote File Inclusion
PHP remote file inclusion vulnerability in system/_b/contentFiles/gBIndex.php in BolinOS 4.5.5 and earlier allows remote
23RISK
open ↗Referência✓ VexDay Proof
smeweb 1.4b - SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in catalog.php in SMEWeb 1.4b and 1.4f allow remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
realm CMS 2.3 - Multiple Vulnerabilities
SQL injection vulnerability in the KeyWordsList function in _includes/inc_routines.asp in Realm CMS 2.3 and earlier allo
23RISK
open ↗Referência✓ VexDay Proof
Active Photo Gallery 6.2 - Authentication Bypass
SQL injection vulnerability in account.asp in Active Photo Gallery 6.2 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component com_books - 'book_id' SQL Injection
SQL injection vulnerability in the Books (com_books) component for Joomla! allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
DELTAScripts PHP Shop 1.0 - Authentication Bypass
SQL injection vulnerability in admin/login.php in DeltaScripts PHP Shop 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
WinFTP Server 2.3.0 - 'PASV Mode' Remote Denial of Service
WinFTP FTP Server 2.3.0, when passive (aka PASV) mode is used, allows remote authenticated users to cause a denial of se
43RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.