Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2021-41382
Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface.
23RISK
open ↗Referência
CVE-2021-41382
Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface.
23RISK
open ↗Referência
CVE-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗Referência
CVE-2026-15317
Sipeed PicoClaw Guarded Web Fetch Flow web.go WebFetchTool.Execute server-side request forgery
33RISK
open ↗Referência
CVE-2026-11869
WP DSGVO Tools (GDPR) < 3.1.40 - Unauthenticated Sensitive Information Disclosure via Subject Access Request
33RISK
open ↗Referência
CVE-2026-23697
Vtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents Module
41RISK
open ↗Referência
CVE-2026-82554
SourceCodester Queue Management System add_customer.php cross site scripting
33RISK
open ↗Referência
CVE-2026-82541
itsourcecode Sales and Inventory System sup_edit.php sql injection
33RISK
open ↗Referência
CVE-2026-11518
SourceCodester Inventory System User Management users.php cross site scripting
33RISK
open ↗Referência
CVE-2021-47983
WordPress Plugin Stripe Payments < 2.0.40 Stored XSS via currency_code
33RISK
open ↗Referência
CVE-2026-10617
nextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication
33RISK
open ↗Referência
CVE-2026-10616
nextlevelbuilder GoClaw Team Task Completion team_tasks_lifecycle.go TeamTasksTool.executeComplete authorization
33RISK
open ↗Referência
CVE-2026-10264
lharries whatsapp-mcp Send API Endpoint main.go SendMessageRequest path traversal
33RISK
open ↗Referência
CVE-2026-10256
itsourcecode Content Management System save_comment.php sql injection
33RISK
open ↗Referência
CVE-2026-10255
SourceCodester Pharmacy Sales and Inventory System ShowForm.php sell_statement access control
33RISK
open ↗Referência
CVE-2026-10254
SourceCodester Pet Grooming Management Software admin file information disclosure
33RISK
open ↗Referência
CVE-2026-10248
SourceCodester Pharmacy Sales and Inventory System Supplier Creation export create_supplier csv injection
33RISK
open ↗Referência
CVE-2026-10247
SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting
33RISK
open ↗Referência
CVE-2026-10241
jeecgboot The server processes these URLs Cloud Instance Metadata Endpoint debug FileDownloadUtils.download2DiskFromNet server-side request forgery
33RISK
open ↗Referência
CVE-2026-89007
Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization
28RISK
open ↗Referência
CVE-2026-34102
Guardian Language-System SQL Injection via id Parameter in job_info_get.php
41RISK
open ↗Referência
CVE-2026-58454
JAIOTlink C492A-W6 4.8.30.57701411 RCE via /Anyka/config Endpoint
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.