Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-12395
WP Job Portal < 2.5.5 - Subscriber+ SQL Injection via Applied Resumes 'ta' Parameter
33RISK
open ↗Referência✓ VexDay Proof
PHlyMail Lite 3.4.4 - 'mod.listmail.php' Remote File Inclusion
PHP remote file inclusion vulnerability in handlers/email/mod.listmail.php in PHlyMail Lite 3.4.4 and earlier (Build 3.0
23RISK
open ↗Referência✓ VexDay Proof
TinyPHP Forum 3.6 - 'profile.php' Remote Code Execution
Directory traversal vulnerability in profile.php in TinyPHPforum 3.6 and earlier allows remote attackers to include and
23RISK
open ↗Referência
CVE-2020-5752
Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitra
38RISK
open ↗Referência
CVE-2020-5791
Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admi
60RISK
open ↗Referência
CVE-2018-17394
SQL Injection exists in the Timetable Schedule 3.6.8 component for Joomla! via the eid parameter.
23RISK
open ↗Referência
CVE-2022-46770
qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of s
61RISK
open ↗Referência
CVE-2022-47874
Improper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to view details of dat
38RISK
open ↗Referência
CVE-2018-17397
SQL Injection exists in the AlphaIndex Dictionaries 1.0 component for Joomla! via the letter parameter.
23RISK
open ↗Referência
CVE-2022-48194
TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a De
53RISK
open ↗Referência
CVE-2026-7844
chatchat-space Langchain-Chatchat Compatible File Service openai_routes.py delete_file missing authentication
33RISK
open ↗Referência
CVE-2026-7834
EFM ipTIME NAS1dual misc_main.cgi get_csrf_whites stack-based overflow
48RISK
open ↗Referência
CVE-2026-7833
EFM ipTIME C200 ApplyRestore Endpoint iux_set.cgi sub_408F90 command injection
41RISK
open ↗Referência
CVE-2023-54346
WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download
41RISK
open ↗Referência
CVE-2026-14790
GPAC Media File write_nhml.c nhmldump_send_frame null pointer dereference
33RISK
open ↗Referência
CVE-2026-14725
SourceCodester Online Boat Reservation System session expiration
33RISK
open ↗Referência✓ VexDay Proof
Fantastic News 2.1.4 - Multiple Remote File Inclusions
PHP remote file inclusion vulnerability in headlines.php in Fantastic News 2.1.4, and possibly earlier, allows remote at
23RISK
open ↗Referência
CVE-2022-50973
Yonyou KSOA 9.0 Unauthenticated File Upload RCE via ImageUpload Servlet
48RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.