Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2020-25213
CVE-2020-25213CRITICALunder attack
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra
100RISK
open ↗
Referência
CVE-2026-110631
CVE-2026-110631CRITICAL
Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration
48RISK
open ↗
Referência
CVE-2026-108810
CVE-2026-108810MEDIUM
tsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure
33RISK
open ↗
Referência
CVE-2015-7450
CVE-2015-7450CRITICALunder attack
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and
100RISK
open ↗
Referência
CVE-2026-108707
CVE-2026-108707CRITICAL
Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect
48RISK
open ↗
Referência
CVE-2026-108707
CVE-2026-108707CRITICAL
Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect
48RISK
open ↗
Referência
CVE-2026-94257
CVE-2026-94257HIGH
SMS Alert 3.9.6 - 4.0.2 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
41RISK
open ↗
Referência
CVE-2020-2555
CVE-2020-2555CRITICALunder attack
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Su
100RISK
open ↗
Referência
CVE-2020-2555
CVE-2020-2555CRITICALunder attack
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Su
100RISK
open ↗
Referência
CVE-2016-0049
CVE-2016-0049—
Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server
28RISK
open ↗
Referência
CVE-2026-108629
CVE-2026-108629MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission datarule Endpoint
33RISK
open ↗
Referência
PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery (Delete admin shoutbox message)
CVE-2020-35687—webappsphp
PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker
23RISK
open ↗
Referência
CVE-2016-0861
CVE-2016-0861—
General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authentica
28RISK
open ↗
Referência
CVE-2016-10033
CVE-2016-10033CRITICALunder attack
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RISK
open ↗
Referência
CVE-2026-89002
CVE-2026-89002MEDIUM
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview
33RISK
open ↗
Referência
CVE-2020-3956
CVE-2020-3956—
VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4
28RISK
open ↗
Referência✓ VexDay Proof
Hospital Management System 4.0 - Persistent Cross-Site Scripting
CVE-2020-5191—webappsphp
PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple Persistent XSS vulnerabilities.
38RISK
open ↗
Referência
CVE-2020-5902
CVE-2020-5902CRITICALunder attackransomware
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic
100RISK
open ↗
Referência
CVE-2026-96513
CVE-2026-96513MEDIUM
Neethuharii CafeManagement AddProductCode.php unrestricted upload
33RISK
open ↗
Referência
CVE-2026-93507
CVE-2026-93507LOW
WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure
28RISK
open ↗
Referência
CVE-2026-91077
CVE-2026-91077LOW
Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_list
28RISK
open ↗
Referência
CVE-2026-91073
CVE-2026-91073MEDIUM
Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting
33RISK
open ↗
Referência
CVE-2026-91025
CVE-2026-91025MEDIUM
Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR
33RISK
open ↗
Referência
CVE-2026-14703
CVE-2026-14703MEDIUM
itsourcecode Hospital Management System patientorder.php sql injection
33RISK
open ↗
Referência
CVE-2026-91024
CVE-2026-91024MEDIUM
Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)
33RISK
open ↗
Referência
CVE-2016-1287
CVE-2016-1287—
Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0
45RISK
open ↗
Referência
CVE-2016-1593
CVE-2016-1593—
Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remot
50RISK
open ↗
Referência
CVE-2026-108607
CVE-2026-108607MEDIUM
JeecgBoot through 3.9.5 IDOR via deleteVideoRecord userId Parameter
33RISK
open ↗
Referência
CVE-2026-108606
CVE-2026-108606MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/deleteById
33RISK
open ↗
Referência
CVE-2026-87780
CVE-2026-87780HIGH
LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping Rules
41RISK
open ↗
← previouspage 860 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.