Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-9426
CVE-2026-9426HIGH
Edimax EW-7438RPn formHwSet stack-based overflow
41RISK
open ↗
Referência
CVE-2026-9416
CVE-2026-9416MEDIUM
code-projects Employee Management System myprofile.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-9415
CVE-2026-9415MEDIUM
code-projects Employee Management System eloginwel.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-9413
CVE-2026-9413MEDIUM
SourceCodester Indian Invoicing System category.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-9412
CVE-2026-9412MEDIUM
SourceCodester Indian Invoicing System Backend Endpoint access control
33RISK
open ↗
Referência
CVE-2026-9411
CVE-2026-9411MEDIUM
SourceCodester Indian Invoicing System Invoice Generation IGST_Invoice.php sql injection
33RISK
open ↗
Referência
CVE-2026-9410
CVE-2026-9410MEDIUM
Sushmi-pal Invoice-System Profile Workflow profile improper authorization
33RISK
open ↗
Referência
CVE-2026-9409
CVE-2026-9409MEDIUM
Sushmi-pal Invoice-System User Management user improper authorization
33RISK
open ↗
Referência
CVE-2026-9407
CVE-2026-9407CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection
48RISK
open ↗
Referência
CVE-2026-9406
CVE-2026-9406CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection
48RISK
open ↗
Referência
CVE-2026-94110
CVE-2026-94110MEDIUM
QCMS Content Detail Controllers.php self_Tmp sql injection
33RISK
open ↗
Referência
CVE-2023-4168
CVE-2023-4168MEDIUM
Templatecookie Adlisting Redirect ad-list information disclosure
60RISK
open ↗
Referência
CVE-2026-80340
CVE-2026-80340MEDIUM
Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay
33RISK
open ↗
Referência
CVE-2023-4174
CVE-2023-4174LOW
mooSocial mooStore cross site scripting
43RISK
open ↗
Referência
CVE-2019-1653
CVE-2019-1653HIGHunder attack
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
100RISK
open ↗
Referência
CVE-2026-12497
CVE-2026-12497HIGH
ProfilePress < 4.16.18 - Unauthenticated Privilege Escalation via Registration Role Selection
41RISK
open ↗
Referência
CVE-2026-16119
CVE-2026-16119MEDIUM
nextlevelbuilder GoClaw WebSocket Approval Endpoint exec_approval.go RequestApproval authorization
33RISK
open ↗
Referência
CVE-2026-16088
CVE-2026-16088MEDIUM
halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal
33RISK
open ↗
Referência
CVE-2026-80115
CVE-2026-80115MEDIUM
PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Crash via DirectIo64.sys MSR Write IOCTL
33RISK
open ↗
Referência
CVE-2026-66750
CVE-2026-66750MEDIUM
Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route
33RISK
open ↗
Referência
CVE-2026-102374
CVE-2026-102374MEDIUM
GestSup before 3.2.62 Stored XSS via Double-Decoded Email Subject in OAuth IMAP Connector
33RISK
open ↗
Referência
CVE-2026-93980
CVE-2026-93980MEDIUM
code-projects Internship Management System Admin Login Form login.php sql injection
33RISK
open ↗
Referência
CVE-2019-9194
CVE-2019-9194—
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.
60RISK
open ↗
Referência
CVE-2026-93979
CVE-2026-93979MEDIUM
code-projects Internship Management System login.php sql injection
33RISK
open ↗
Referência
CVE-2018-18763
CVE-2018-18763—
SaltOS 3.1 r8126 allows action=ajax&query=numbers&page=usuarios&action2=[SQL] SQL Injection.
23RISK
open ↗
Referência
CVE-2026-14802
CVE-2026-14802MEDIUM
react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injection
33RISK
open ↗
Referência
CVE-2018-18763
CVE-2018-18763—
SaltOS 3.1 r8126 allows action=ajax&query=numbers&page=usuarios&action2=[SQL] SQL Injection.
23RISK
open ↗
Referência
CVE-2026-87966
CVE-2026-87966MEDIUM
Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR
33RISK
open ↗
Referência✓ VexDay Proof
QnECMS 2.5.6 - 'adminfolderpath' Remote File Inclusion
CVE-2006-5627—webappsphp
Multiple PHP remote file inclusion vulnerabilities in QnECMS 2.5.6 and earlier allow remote attackers to execute arbitra
28RISK
open ↗
Referência
CVE-2026-13499
CVE-2026-13499MEDIUM
yashpokharna2555 restaurent-management-system Registration login_register.php cross site scripting
33RISK
open ↗
← previouspage 852 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.