Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-17019
CVE-2026-17019MEDIUM
JetEngine < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG)
33RISK
open ↗
Referência
CVE-2026-19378
CVE-2026-19378MEDIUM
code-projects Task Management System CommentSave.php cross site scripting
33RISK
open ↗
Referência
CVE-2014-2424
CVE-2014-2424—
Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote
50RISK
open ↗
Referência
CVE-2018-7739
CVE-2018-7739—
antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and
35RISK
open ↗
Referência
CVE-2014-3138
CVE-2014-3138—
SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1
23RISK
open ↗
Referência
CVE-2026-108644
CVE-2026-108644MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/category/delete
33RISK
open ↗
Referência
CVE-2026-108642
CVE-2026-108642MEDIUM
JeecgBoot through 3.9.5 IDOR via PUT /sys/sysAnnouncementSend/edit
33RISK
open ↗
Referência
CVE-2026-114574
CVE-2026-114574MEDIUM
massCodeIO massCode Local HTTP Service index.ts information disclosure
33RISK
open ↗
Referência
CVE-2026-13319
CVE-2026-13319MEDIUM
Authorization Bypass Through User-Controlled Key in GitLab
33RISK
open ↗
Referência
CVE-2026-13553
CVE-2026-13553MEDIUM
itsourcecode Online Hotel Management System controller.php add unrestricted upload
33RISK
open ↗
Referência
CVE-2026-104638
CVE-2026-104638MEDIUM
onetwothreeneth HospitalManagementSystem sessions.php improper authentication
33RISK
open ↗
Referência
CVE-2026-108610
CVE-2026-108610MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/word/edit Endpoint
33RISK
open ↗
Referência
CVE-2026-108546
CVE-2026-108546HIGH
Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration
41RISK
open ↗
Referência
CVE-2026-108545
CVE-2026-108545HIGH
SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing
41RISK
open ↗
Referência✓ VexDay Proof
Webmin 1.920 - Unauthenticated Remote Code Execution (Metasploit)
CVE-2019-15107CRITICALunder attackransomwareremotelinux
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RISK
open ↗
Referência
CVE-2019-1653
CVE-2019-1653HIGHunder attack
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
100RISK
open ↗
Referência
CVE-2019-16759
CVE-2019-16759CRITICALunder attack
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge
100RISK
open ↗
Referência
CVE-2019-17220
CVE-2019-17220—
Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line.
23RISK
open ↗
Referência
CVE-2021-41878
CVE-2021-41878—
A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enable
38RISK
open ↗
Referência
CVE-2021-42013
CVE-2021-42013CRITICALunder attackransomware
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RISK
open ↗
Referência
CVE-2019-17558
CVE-2019-17558HIGHunder attack
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A V
100RISK
open ↗
Referência
CVE-2026-105195
CVE-2026-105195LOW
Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure
28RISK
open ↗
Referência
CVE-2026-103646
CVE-2026-103646CRITICAL
Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter
48RISK
open ↗
Referência
CVE-2014-4613
CVE-2014-4613—
Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attacke
23RISK
open ↗
Referência
X.Org X Server 1.20.4 - Local Stack Overflow
CVE-2019-17624—locallinux
"" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. For example, by sendin
23RISK
open ↗
Referência
Open-AudIT 3.3.0 - Reflective Cross-Site Scripting (Authenticated)
CVE-2020-12261—webappsphp
Open-AudIT 3.3.0 allows an XSS attack after login.
23RISK
open ↗
Referência
CVE-2026-107269
CVE-2026-107269MEDIUM
Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy
33RISK
open ↗
Referência
CVE-2026-112042
CVE-2026-112042MEDIUM
diem-project diem dmWidget dmBaseLinkTag.php text cross site scripting
33RISK
open ↗
Referência
CVE-2026-112041
CVE-2026-112041MEDIUM
diem-project diem dmString.php random weak prng
33RISK
open ↗
Referência
CVE-2026-112040
CVE-2026-112040MEDIUM
diem-project diem Sign-In BasedmUserActions.class.php redirect
33RISK
open ↗
← previouspage 856 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.