Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-107120
CVE-2026-107120MEDIUM
Contest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN
33RISK
open ↗
Referência
CVE-2026-120282
CVE-2026-120282CRITICAL
WAVLINK WN536AX6-A protocol.csp host_black os command injection
48RISK
open ↗
Referência
CVE-2018-13458
CVE-2018-13458—
qh_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to
23RISK
open ↗
Referência
CVE-2026-120281
CVE-2026-120281CRITICAL
WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow
48RISK
open ↗
Referência
CVE-2026-120280
CVE-2026-120280CRITICAL
WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection
48RISK
open ↗
Referência
CVE-2018-13832
CVE-2018-13832—
Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plu
23RISK
open ↗
Referência
CVE-2026-120279
CVE-2026-120279CRITICAL
WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection
48RISK
open ↗
Referência
CVE-2026-61461
CVE-2026-61461HIGH
Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text
41RISK
open ↗
Referência
CVE-2026-15374
CVE-2026-15374MEDIUM
Eleveo Call Recording Software Group roleAddAction.do improper authorization
33RISK
open ↗
Referência
CVE-2026-15373
CVE-2026-15373MEDIUM
Eleveo Call Recording Software userAddAction.do improper authorization
33RISK
open ↗
Referência
CVE-2026-15330
CVE-2026-15330MEDIUM
zhayujie CowAgent Vision Tool vision.py _download_to_data_url server-side request forgery
33RISK
open ↗
Referência
CVE-2026-15329
CVE-2026-15329MEDIUM
zhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosure
33RISK
open ↗
Referência
CVE-2026-15326
CVE-2026-15326MEDIUM
halo-dev halo Theme Installation ThemeUtils.java ThemeUtils.unzipThemeTo path traversal
33RISK
open ↗
Referência
CVE-2026-15321
CVE-2026-15321MEDIUM
MyEMS Admin Backend svg.py on_post cross site scripting
33RISK
open ↗
Referência
CVE-2026-15202
CVE-2026-15202MEDIUM
YzmCMS Header yzmphp.php get_url cross site scripting
33RISK
open ↗
Referência✓ VexDay Proof
Gateway Weblaunch - ActiveX Control Insecure Method
CVE-2008-0220—remotewindows
Multiple stack-based buffer overflows in the WebLaunch.WeblaunchCtl.1 (aka CWebLaunchCtl) ActiveX control in weblaunch.o
28RISK
open ↗
Referência✓ VexDay Proof
AShop Deluxe 4.x - 'catalogue.php' SQL Injection
CVE-2008-3136—webappsphp
SQL injection vulnerability in catalogue.php in AShop Deluxe 4.x allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência
CVE-2026-104677
CVE-2026-104677HIGH
WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP
41RISK
open ↗
Referência✓ VexDay Proof
SmartPPC Pay Per Click Script - 'idDirectory' Blind SQL Injection (1)
CVE-2008-3152—webappsphp
SQL injection vulnerability in directory.php in SmartPPC and SmartPPC Pro allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência
CVE-2018-7297
CVE-2018-7297—
Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers
35RISK
open ↗
Referência✓ VexDay Proof
aflog 1.01 - Cross-Site Scripting / SQL Injection
CVE-2008-0398—webappsphp
Cross-site scripting (XSS) vulnerability in aflog 1.01, and possibly earlier versions, allows remote attackers to inject
23RISK
open ↗
Referência
CVE-2018-15982
CVE-2018-15982HIGHunder attackransomware
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful
93RISK
open ↗
Referência
CVE-2026-120225
CVE-2026-120225CRITICAL
Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal
48RISK
open ↗
Referência
CVE-2019-0796
CVE-2019-0796—
An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), ak
23RISK
open ↗
Referência
CVE-2026-120224
CVE-2026-120224CRITICAL
Oray Pugongying X5 Pro API Authorization run_async_task improper authorization
48RISK
open ↗
Referência
CVE-2026-120223
CVE-2026-120223LOW
Oray Pugongying X5 Pro Session ID session.lua session_get random values
28RISK
open ↗
Referência✓ VexDay Proof
eStoreAff 0.1 - 'cid' SQL Injection
CVE-2008-3484—webappsphp
SQL injection vulnerability in eStoreAff 0.1 allows remote attackers to execute arbitrary SQL commands via the cid param
23RISK
open ↗
Referência
CVE-2026-58579
CVE-2026-58579MEDIUM
RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name
33RISK
open ↗
Referência
CVE-2026-58578
CVE-2026-58578HIGH
LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Import
41RISK
open ↗
Referência
CVE-2024-58352
CVE-2024-58352HIGH
Landray OA Unauthenticated HQL Injection via wechatLoginHelper.do
41RISK
open ↗
← previouspage 845 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.