Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-108799
CVE-2026-108799MEDIUM
jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection
33RISK
open ↗
Referência
CVE-2026-108891
CVE-2026-108891MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId
33RISK
open ↗
Referência
CVE-2026-108888
CVE-2026-108888MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls
33RISK
open ↗
Referência
CVE-2026-85118
CVE-2026-85118CRITICAL
AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion
48RISK
open ↗
Referência
CVE-2026-84261
CVE-2026-84261HIGH
click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications
41RISK
open ↗
Referência
CVE-2015-7243
CVE-2015-7243—
Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly
50RISK
open ↗
Referência
CVE-2015-7257
CVE-2015-7257—
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrato
23RISK
open ↗
Referência
CVE-2015-7258
CVE-2015-7258—
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain
28RISK
open ↗
Referência
CVE-2015-7297
CVE-2015-7297—
SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via un
60RISK
open ↗
Referência
Mara CMS 7.5 - Reflective Cross-Site Scripting
CVE-2020-24223—webappsphp
Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.
43RISK
open ↗
Referência
CVE-2020-24949
CVE-2020-24949—
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a cr
50RISK
open ↗
Referência
CVE-2020-25213
CVE-2020-25213CRITICALunder attack
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra
100RISK
open ↗
Referência
CVE-2026-110631
CVE-2026-110631CRITICAL
Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration
48RISK
open ↗
Referência
CVE-2026-108810
CVE-2026-108810MEDIUM
tsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure
33RISK
open ↗
Referência
CVE-2015-7450
CVE-2015-7450CRITICALunder attack
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and
100RISK
open ↗
Referência
CVE-2026-108707
CVE-2026-108707CRITICAL
Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect
48RISK
open ↗
Referência
CVE-2026-108707
CVE-2026-108707CRITICAL
Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect
48RISK
open ↗
Referência
CVE-2026-94257
CVE-2026-94257HIGH
SMS Alert 3.9.6 - 4.0.2 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
41RISK
open ↗
Referência
CVE-2020-2555
CVE-2020-2555CRITICALunder attack
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Su
100RISK
open ↗
Referência
CVE-2020-2555
CVE-2020-2555CRITICALunder attack
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Su
100RISK
open ↗
Referência
CVE-2026-108645
CVE-2026-108645MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/category/edit
33RISK
open ↗
Referência
CVE-2026-108638
CVE-2026-108638MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser
33RISK
open ↗
Referência
CVE-2026-108637
CVE-2026-108637MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint
33RISK
open ↗
Referência
CVE-2026-108636
CVE-2026-108636MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepart/appImportExcel
33RISK
open ↗
Referência
CVE-2015-8562
CVE-2015-8562—
Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbi
60RISK
open ↗
Referência
CVE-2015-8660
CVE-2015-8660—
The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr op
43RISK
open ↗
Referência
CVE-2016-0006
CVE-2016-0006—
The sandbox implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8,
23RISK
open ↗
Referência
CVE-2026-103043
CVE-2026-103043HIGH
anchorme through 3.0.8 Regular Expression Denial of Service
41RISK
open ↗
Referência
CVE-2020-35313
CVE-2020-35313—
A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in Wonder
35RISK
open ↗
Referência
CVE-2026-96532
CVE-2026-96532HIGH
Testimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post Update
41RISK
open ↗
← previouspage 859 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.