Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-16258
CVE-2026-16258CRITICAL
Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint
48RISK
open ↗
Referência
CVE-2026-102913
CVE-2026-102913MEDIUM
SourceCodester Car Driving School Management System Master.php save_enrollment sql injection
33RISK
open ↗
Referência
CVE-2026-102844
CVE-2026-102844MEDIUM
gedelumbung HospitalManagement laporan_data_pasien.php detail authorization
33RISK
open ↗
Referência
CVE-2026-102616
CVE-2026-102616MEDIUM
risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection
33RISK
open ↗
Referência
CVE-2026-15147
CVE-2026-15147MEDIUM
Five Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR
33RISK
open ↗
Referência
CVE-2026-10524
CVE-2026-10524HIGH
CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation
41RISK
open ↗
Referência✓ VexDay Proof
PHProjekt 5.1 - Multiple Remote File Inclusions
CVE-2006-4204—webappsphp
Multiple PHP remote file inclusion vulnerabilities in PHProjekt 5.1 and possibly earlier allow remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
ProjectButler 0.8.4 - 'rootdir' Remote File Inclusion
CVE-2006-4205—webappsphp
Multiple PHP remote file inclusion vulnerabilities in WebDynamite ProjectButler 0.8.4 allow remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
PHPay 2.02 - 'nu_mail.inc.php?mail()' Remote Injection
CVE-2006-4210—webappsphp
nu_mail.inc.php in Andreas Kansok phPay 2.02 and 2.02.1, when register_globals is enabled, allows remote attackers to us
23RISK
open ↗
Referência✓ VexDay Proof
Thatware 0.4.6 - 'ROOT_PATH' Remote File Inclusion
CVE-2006-4213—webappsphp
PHP remote file inclusion vulnerability in config.php in David Kent Norman Thatware 0.4.6 and possibly earlier allows re
23RISK
open ↗
Referência
CVE-2026-14314
CVE-2026-14314MEDIUM
PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR
33RISK
open ↗
Referência
CVE-2026-14313
CVE-2026-14313MEDIUM
PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR
33RISK
open ↗
Referência
CVE-2026-13514
CVE-2026-13514LOW
Chess Play and Learn App com.chess AndroidManifest.xml backup
28RISK
open ↗
Referência
CVE-2026-13513
CVE-2026-13513LOW
MyScale MyScaleDB SegmentId.h getCacheKey data authenticity
28RISK
open ↗
Referência
CVE-2026-13512
CVE-2026-13512MEDIUM
Databend Tenant client_session_manager.rs state_key authorization
33RISK
open ↗
Referência
CVE-2022-29727
CVE-2022-29727—
Survey Sparrow Enterprise Survey Software 2022 has a Stored cross-site scripting (XSS) vulnerability in the Signup param
23RISK
open ↗
Referência
CVE-2026-57518
CVE-2026-57518HIGH
Pagekit CMS 1.0.18 Privilege Escalation via UserApiController
41RISK
open ↗
Referência
CVE-2026-45257
CVE-2026-45257HIGH
Arbitrary file overwrite via the KTLS receive path
41RISK
open ↗
Referência
CVE-2026-36908
CVE-2026-36908MEDIUM
A stack overflow in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of axiomatic-systems Bento4 before v1.8
33RISK
open ↗
Referência
CVE-2026-10753
CVE-2026-10753LOW
Site Kit by Google < 1.176.0 - Editor+ Email Reporting Settings Update
28RISK
open ↗
Referência
Joomla! Component JSP Tickets 1.1 - SQL Injection
CVE-2018-6609—webappsphp
SQL Injection exists in the JSP Tickets 1.1 component for Joomla! via the ticketcode parameter in a ticketlist edit acti
23RISK
open ↗
Referência
CVE-2018-6789
CVE-2018-6789CRITICALunder attackransomware
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted mes
100RISK
open ↗
Referência
CVE-2026-18607
CVE-2026-18607HIGH
Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow
41RISK
open ↗
Referência
CVE-2018-6941
CVE-2018-6941—
A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remot
23RISK
open ↗
Referência
CVE-2018-17254
CVE-2018-17254—
The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.
60RISK
open ↗
Referência
CVE-2006-3995
CVE-2006-3995—
Multiple PHP remote file inclusion vulnerabilities in (1) uhp_config.php, and possibly (2) footer.php, (3) functions.php
28RISK
open ↗
Referência
CVE-2026-67611
CVE-2026-67611HIGH
OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
41RISK
open ↗
Referência
CVE-2026-100887
CVE-2026-100887MEDIUM
amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_builder.php order_by sql injection
33RISK
open ↗
Referência
CVE-2026-13690
CVE-2026-13690HIGH
UsersWP < 1.2.67 - Two-Factor Authentication Bypass
41RISK
open ↗
Referência
CVE-2026-13714
CVE-2026-13714CRITICAL
Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
48RISK
open ↗
← previouspage 848 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.