Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-12130
CodeAstro Human Resource Management System Projects Management Add_Projects cross site scripting
33RISK
open ↗Referência
CVE-2026-11447
GL.iNet GL-MT3000 MTK Backend iwinfo.so iwinfo_backend command injection
33RISK
open ↗Referência
CVE-2026-11411
iAI Lab PDF AI App chatpdf.pro getExternalCacheDir path traversal
33RISK
open ↗Referência
CVE-2018-25408
The Open ISES Project 3.30A Path Traversal Arbitrary File Download
41RISK
open ↗Referência
CVE-2026-9405
Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection
48RISK
open ↗Referência
Manage Engine ServiceDesk Plus 10.0 - Privilege Escalation
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session
28RISK
open ↗Referência
CVE-2018-19246
PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users w
28RISK
open ↗Referência
CVE-2026-16620
WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Select Mode
41RISK
open ↗Referência✓ VexDay Proof
CoolPlayer 2.17 - '.m3u' Local Stack Overflow
Multiple buffer overflows in Niek Albers CoolPlayer 216 and earlier allow remote attackers to execute arbitrary code via
23RISK
open ↗Referência
CVE-2026-11872
Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save_clever_menu_item
33RISK
open ↗Referência
CVE-2019-14348
The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via
28RISK
open ↗Referência
CVE-2026-16032
LWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring
33RISK
open ↗Referência
CVE-2026-112207
Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link
41RISK
open ↗Referência
CVE-2026-14234
WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF
41RISK
open ↗Referência
CVE-2026-15239
Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key
33RISK
open ↗Referência
CVE-2026-14224
Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR
33RISK
open ↗Referência
CVE-2026-11767
CRT Addons for Elementor < 1.6.7 - Unauthenticated Stored XSS via Contact Form
41RISK
open ↗Referência
CVE-2026-63767
ktransformers Unauthenticated Pickle Deserialization RCE via ZMQ
48RISK
open ↗Referência
CVE-2026-63768
cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State
33RISK
open ↗Referência
CVE-2019-15637
Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to informat
46RISK
open ↗Referência
CVE-2019-15742
A local privilege-escalation vulnerability exists in the Poly Plantronics Hub before 3.14 for Windows client application
38RISK
open ↗Referência
CVE-2026-82485
itsourcecode Sales and Inventory System pro_edit.php sql injection
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.