Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-101301
CVE-2026-101301MEDIUM
WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass
33RISK
open ↗
Referência
CVE-2026-96904
CVE-2026-96904MEDIUM
AWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Page
33RISK
open ↗
Referência
CVE-2015-7243
CVE-2015-7243—
Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly
50RISK
open ↗
Referência
CVE-2015-7257
CVE-2015-7257—
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrato
23RISK
open ↗
Referência
CVE-2015-7258
CVE-2015-7258—
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain
28RISK
open ↗
Referência
CVE-2015-7297
CVE-2015-7297—
SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via un
60RISK
open ↗
Referência
Mara CMS 7.5 - Reflective Cross-Site Scripting
CVE-2020-24223—webappsphp
Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.
43RISK
open ↗
Referência
CVE-2020-24949
CVE-2020-24949—
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a cr
50RISK
open ↗
Referência
CVE-2020-25213
CVE-2020-25213CRITICALunder attack
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra
100RISK
open ↗
Referência
CVE-2026-110631
CVE-2026-110631CRITICAL
Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration
48RISK
open ↗
Referência
CVE-2026-108810
CVE-2026-108810MEDIUM
tsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure
33RISK
open ↗
Referência
CVE-2015-7450
CVE-2015-7450CRITICALunder attack
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and
100RISK
open ↗
Referência
CVE-2026-108707
CVE-2026-108707CRITICAL
Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect
48RISK
open ↗
Referência
CVE-2026-108707
CVE-2026-108707CRITICAL
Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect
48RISK
open ↗
Referência
CVE-2026-94257
CVE-2026-94257HIGH
SMS Alert 3.9.6 - 4.0.2 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
41RISK
open ↗
Referência
CVE-2020-2555
CVE-2020-2555CRITICALunder attack
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Su
100RISK
open ↗
Referência
CVE-2020-2555
CVE-2020-2555CRITICALunder attack
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Su
100RISK
open ↗
Referência
CVE-2016-0049
CVE-2016-0049—
Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server
28RISK
open ↗
Referência
CVE-2026-108629
CVE-2026-108629MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission datarule Endpoint
33RISK
open ↗
Referência
PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery (Delete admin shoutbox message)
CVE-2020-35687—webappsphp
PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker
23RISK
open ↗
Referência
CVE-2016-0861
CVE-2016-0861—
General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authentica
28RISK
open ↗
Referência
CVE-2016-10033
CVE-2016-10033CRITICALunder attack
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RISK
open ↗
Referência
CVE-2026-89002
CVE-2026-89002MEDIUM
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview
33RISK
open ↗
Referência
CVE-2020-3956
CVE-2020-3956—
VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4
28RISK
open ↗
Referência✓ VexDay Proof
Hospital Management System 4.0 - Persistent Cross-Site Scripting
CVE-2020-5191—webappsphp
PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple Persistent XSS vulnerabilities.
38RISK
open ↗
Referência
CVE-2020-5902
CVE-2020-5902CRITICALunder attackransomware
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic
100RISK
open ↗
Referência
CVE-2026-96513
CVE-2026-96513MEDIUM
Neethuharii CafeManagement AddProductCode.php unrestricted upload
33RISK
open ↗
Referência
CVE-2026-93507
CVE-2026-93507LOW
WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure
28RISK
open ↗
Referência
CVE-2026-91077
CVE-2026-91077LOW
Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_list
28RISK
open ↗
Referência
CVE-2026-91073
CVE-2026-91073MEDIUM
Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting
33RISK
open ↗
← previouspage 857 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.