Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2025-71284
Synway SMG Gateway Management Software OS Command Injection via radius_address
48RISK
open ↗Referência
CVE-2026-5407
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
33RISK
open ↗Referência
CVE-2026-6534
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
33RISK
open ↗Referência
CVE-2026-6531
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
33RISK
open ↗Referência
CVE-2026-7447
SourceCodester Pet Grooming Management Software update_customer.php sql injection
33RISK
open ↗Referência
CVE-2026-7446
VetCoders mcp-server-semgrep MCP index.ts create_rule os command injection
33RISK
open ↗Referência
CVE-2026-7445
ZachHandley ZMCPTools MCP Log Resource ResourceManager.ts path traversal
33RISK
open ↗Referência
CVE-2022-0824
Improper Access Control to Remote Code Execution in webmin/webmin
78RISK
open ↗Referência✓ VexDay Proof
Ikon ADManager 2.1 - Remote Database Disclosure
Ikon AdManager 2.1 and earlier stores sensitive information under the web root with insufficient access control, which a
23RISK
open ↗Referência
CVE-2026-11880
Fluent Forms < 6.2.1 - Subscriber+ Subscription Cancellation via IDOR
28RISK
open ↗Referência
CVE-2026-58172
Ocelot - IP Allow/Block List Bypass for WebSocket Upgrade Requests
48RISK
open ↗Referência
CVE-2026-58166
OpenBMB ChatDev - Unauthenticated Path Traversal in Upload Handler Allows Arbitrary File Write and Delete
41RISK
open ↗Referência
CVE-2025-12669
Improper Control of Generation of Code ('Code Injection') in GitLab
33RISK
open ↗Referência✓ VexDay Proof
crossfire-server 1.9.0 - 'SetUp()' Remote Buffer Overflow
Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrar
28RISK
open ↗Referência✓ VexDay Proof
NEWSolved Lite 1.9.2 - 'abs_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in USOLVED NEWSolved Lite 1.9.2, and possibly earlier, allow remote a
28RISK
open ↗Referência
CVE-2020-37236
NewsLister Authenticated Persistent Cross-Site Scripting via Admin Panel
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.