Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-15237
CVE-2026-15237MEDIUM
Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint
33RISK
open ↗
Referência
CVE-2026-107166
CVE-2026-107166MEDIUM
Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources
33RISK
open ↗
Referência
CVE-2026-8782
CVE-2026-8782MEDIUM
omec-project amf NGAP Message handler.go null pointer dereference
33RISK
open ↗
Referência
CVE-2019-5418
CVE-2019-5418HIGHunder attack
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where spe
100RISK
open ↗
Referência
CVE-2018-5702
CVE-2018-5702—
Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access con
28RISK
open ↗
Referência
CVE-2018-5705
CVE-2018-5705—
Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The affected function is its search engine (the t parameter to t
23RISK
open ↗
Referência
CVE-2021-47962
CVE-2021-47962MEDIUM
Savsoft Quiz 5.0 Persistent Cross-Site Scripting via User Settings
33RISK
open ↗
Referência
CVE-2021-47959
CVE-2021-47959HIGH
WordPress Plugin WPGraphQL 1.3.5 Denial of Service
41RISK
open ↗
Referência
CVE-2021-47958
CVE-2021-47958MEDIUM
CouchCMS 2.2.1 Server-Side Request Forgery via SVG upload
33RISK
open ↗
Referência
CVE-2018-5705
CVE-2018-5705—
Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The affected function is its search engine (the t parameter to t
23RISK
open ↗
Referência
CVE-2026-112230
CVE-2026-112230LOW
Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter
28RISK
open ↗
Referência
CVE-2026-112219
CVE-2026-112219MEDIUM
Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route
33RISK
open ↗
Referência
CVE-2026-111966
CVE-2026-111966MEDIUM
Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute
33RISK
open ↗
Referência
CVE-2018-5756
CVE-2018-5756—
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev4
23RISK
open ↗
Referência
CVE-2026-43891
CVE-2026-43891HIGH
changedetection.io: Arbitrary Local File Read via crafted backup restore
41RISK
open ↗
Referência
CVE-2018-5756
CVE-2018-5756—
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev4
23RISK
open ↗
Referência
CVE-2026-8270
CVE-2026-8270MEDIUM
Open5GS SMF ogs_nas_parse_qos_rules denial of service
33RISK
open ↗
Referência
CVE-2021-47936
CVE-2021-47936CRITICAL
OpenCATS 0.9.4 Remote Code Execution via Resume Upload
48RISK
open ↗
Referência
CVE-2021-47927
CVE-2021-47927MEDIUM
WordPress Plugin WP Symposium Pro 2021.10 Stored XSS via wps_admin_forum_add_name
33RISK
open ↗
Referência
CVE-2026-105289
CVE-2026-105289MEDIUM
feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting
33RISK
open ↗
Referência
CVE-2026-105286
CVE-2026-105286MEDIUM
Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal
33RISK
open ↗
Referência
CVE-2026-105285
CVE-2026-105285CRITICAL
Totolink A3002MU QoS Rule formIpQoS stack-based overflow
48RISK
open ↗
Referência
CVE-2026-19210
CVE-2026-19210MEDIUM
SourceCodester Photo Share Website ajax.php save_upload unrestricted upload
33RISK
open ↗
Referência
CVE-2026-65707
CVE-2026-65707HIGH
Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint
41RISK
open ↗
Referência
CVE-2026-12689
CVE-2026-12689MEDIUM
ProfileGrid < 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing Authorization
33RISK
open ↗
Referência
CVE-2018-17173
CVE-2018-17173—
LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getT
50RISK
open ↗
Referência
CVE-2026-16486
CVE-2026-16486MEDIUM
SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-16252
CVE-2026-16252MEDIUM
Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System Staffshinel Ds.jsp sql injection
33RISK
open ↗
Referência
CVE-2026-11466
CVE-2026-11466MEDIUM
zilliztech deep-searcher collection_router.py CollectionRouter.invoke access control
33RISK
open ↗
Referência
CVE-2026-11462
CVE-2026-11462MEDIUM
Chengdu Everbrite Network Technology BeikeShop Stripe Plugin StripeController.php callback improper authorization
33RISK
open ↗
← previouspage 854 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.