Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-111966
CVE-2026-111966MEDIUM
Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute
33RISK
open ↗
Referência
CVE-2019-7256
CVE-2019-7256CRITICALunder attack
Linear eMerge E3-Series devices allow Command Injections.
100RISK
open ↗
Referência
CVE-2019-7256
CVE-2019-7256CRITICALunder attack
Linear eMerge E3-Series devices allow Command Injections.
100RISK
open ↗
Referência
CVE-2019-1663
CVE-2019-1663CRITICAL
Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
85RISK
open ↗
Referência✓ VexDay Proof
BlueShoes Framework 4.6 - Remote File Inclusion
CVE-2006-2864—webappsphp
Multiple PHP remote file inclusion vulnerabilities in BlueShoes Framework 4.6 allow remote attackers to execute arbitrar
28RISK
open ↗
Referência
CVE-2026-111737
CVE-2026-111737LOW
Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists
28RISK
open ↗
Referência
CVE-2026-110537
CVE-2026-110537LOW
Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action
28RISK
open ↗
Referência
CVE-2018-5992
CVE-2018-5992—
SQL Injection exists in the Staff Master through 1.0 RC 1 component for Joomla! via the name parameter in a view=staff r
23RISK
open ↗
Referência
CVE-2026-110510
CVE-2026-110510LOW
Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag
28RISK
open ↗
Referência
CVE-2026-19210
CVE-2026-19210MEDIUM
SourceCodester Photo Share Website ajax.php save_upload unrestricted upload
33RISK
open ↗
Referência
CVE-2026-65707
CVE-2026-65707HIGH
Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint
41RISK
open ↗
Referência
CVE-2026-12689
CVE-2026-12689MEDIUM
ProfileGrid < 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing Authorization
33RISK
open ↗
Referência
CVE-2018-17173
CVE-2018-17173—
LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getT
50RISK
open ↗
Referência
CVE-2026-16486
CVE-2026-16486MEDIUM
SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-16252
CVE-2026-16252MEDIUM
Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System Staffshinel Ds.jsp sql injection
33RISK
open ↗
Referência
CVE-2026-11466
CVE-2026-11466MEDIUM
zilliztech deep-searcher collection_router.py CollectionRouter.invoke access control
33RISK
open ↗
Referência
CVE-2026-11462
CVE-2026-11462MEDIUM
Chengdu Everbrite Network Technology BeikeShop Stripe Plugin StripeController.php callback improper authorization
33RISK
open ↗
Referência
CVE-2026-11461
CVE-2026-11461MEDIUM
NousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorization
33RISK
open ↗
Referência
CVE-2026-11460
CVE-2026-11460MEDIUM
Boost Serialization improper validation of specified type of input
33RISK
open ↗
Referência
CVE-2026-49494
CVE-2026-49494HIGH
Xcitium Client Security / Comodo Internet Security Remote Denial of Service
41RISK
open ↗
Referência
CVE-2026-11456
CVE-2026-11456MEDIUM
Chanjet CRM HTTP GET Request jxf_dump_systable.php sql injection
33RISK
open ↗
Referência
CVE-2026-11453
CVE-2026-11453MEDIUM
Tiobon Employee Self-Service System Login Endpoint BlogSearch.aspx sql injection
33RISK
open ↗
Referência
CVE-2026-103536
CVE-2026-103536MEDIUM
ZongXR Supermarket save Endpoint OrderController.java OrderController.addOrder missing authentication
33RISK
open ↗
Referência
CVE-2026-15629
CVE-2026-15629MEDIUM
louisho5 picobot Workspace filesystem.go GetSkill link following
33RISK
open ↗
Referência
CVE-2026-15628
CVE-2026-15628MEDIUM
zhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision._download_to_data_url server-side request forgery
33RISK
open ↗
Referência
CVE-2026-82608
CVE-2026-82608MEDIUM
Kamailio AVP cxdx_avp.c get_4bytes out-of-bounds
33RISK
open ↗
Referência
Event Manager 1.0 - SQL Injection
CVE-2018-6576—webappsphp
SQL Injection exists in Event Manager 1.0 via the event.php id parameter or the page.php slug parameter.
23RISK
open ↗
Referência
CVE-2026-82601
CVE-2026-82601MEDIUM
SeaCMS err.php cross site scripting
33RISK
open ↗
Referência
Joomla! Component JEXTN Membership 3.1.0 - 'usr_plan' SQL Injection
CVE-2018-6577—webappsphp
SQL Injection exists in the JEXTN Membership 3.1.0 component for Joomla! via the usr_plan parameter in a view=myplans&ta
23RISK
open ↗
Referência
CVE-2026-15537
CVE-2026-15537MEDIUM
SourceCodester Online Book Store System login.php sql injection
33RISK
open ↗
← previouspage 850 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.