Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2021-27520
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "
38RISK
open ↗Referência✓ VexDay Proof
matpo bilder galerie 1.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in includes/tumbnail.php in MatPo Bilder Galerie 1.1 allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Bitweaver R2 CMS - Arbitrary File Upload / Disclosure
Unrestricted file upload vulnerability in fisheye/upload.php in Bitweaver R2 CMS allows remote attackers to upload arbit
23RISK
open ↗Referência✓ VexDay Proof
Bitweaver R2 CMS - Arbitrary File Upload / Disclosure
Directory traversal vulnerability in wiki/edit.php in Bitweaver R2 CMS allows remote attackers to obtain sensitive infor
23RISK
open ↗Referência✓ VexDay Proof
Smeego 1.0 - 'Cookie lang' Local File Inclusion
Directory traversal vulnerability in index.php in Smeego 1.0, when magic_quotes_gpc is disabled, allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
Archangel Weblog 0.90.02 - 'post_id' SQL Injection
SQL injection vulnerability in index.php in Archangel Weblog 0.90.02 and earlier allows remote attackers to execute arbi
23RISK
open ↗Referência
CVE-2026-93548
FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation
41RISK
open ↗Referência
CVE-2026-34111
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac_text.php
48RISK
open ↗Referência
CVE-2026-34105
Guardian Language-System SQL Injection via id Parameter in translate_text.php
41RISK
open ↗Referência
CVE-2026-34104
Guardian Language-System SQL Injection via name Parameter in designer.php
41RISK
open ↗Referência
CVE-2026-11887
Salon Booking System < 10.30.20 - Subscriber+ Booking Approval Bypass
33RISK
open ↗Referência
CVE-2026-58448
yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API
41RISK
open ↗Referência
CVE-2026-58447
Invidious - Cross-User Playlist Video Deletion via Missing Ownership Check
41RISK
open ↗Referência
CVE-2026-58446
Presenton < 0.8.8-beta - Authentication Bypass of Session Auth via Unprotected MCP Endpoint
33RISK
open ↗Referência
CVE-2020-7209
LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.
60RISK
open ↗Referência
CVE-2020-7246
A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code
60RISK
open ↗Referência✓ VexDay Proof
ZeroCMS 1.0 Alpha - Arbitrary File Upload / SQL Injection
Multiple SQL injection vulnerabilities in Zero CMS 1.0 Alpha allow remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Referência✓ VexDay Proof
ResearchGuide 0.5 - 'id' SQL Injection
SQL injection vulnerability in guide.php in ResearchGuide 0.5 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência
CVE-2026-12200
Ritlabs TinyWeb Server Header libeay32.dll.html stack-based overflow
33RISK
open ↗Referência
CVE-2025-71329
image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser
41RISK
open ↗Referência
CVE-2025-71330
image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsing
41RISK
open ↗Referência
CVE-2020-7961
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.