Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-108674
CVE-2026-108674MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /openapi/queryById
33RISK
open ↗
Referência
CVE-2026-108672
CVE-2026-108672MEDIUM
JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser
33RISK
open ↗
Referência
CVE-2026-108670
CVE-2026-108670MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experiment
33RISK
open ↗
Referência
CVE-2026-112062
CVE-2026-112062MEDIUM
lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler
33RISK
open ↗
Referência
CVE-2026-112057
CVE-2026-112057MEDIUM
libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters
33RISK
open ↗
Referência
CVE-2026-112052
CVE-2026-112052MEDIUM
libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing
33RISK
open ↗
Referência
CVE-2026-112018
CVE-2026-112018HIGH
cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()
41RISK
open ↗
Referência
CVE-2026-110031
CVE-2026-110031HIGH
Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key
41RISK
open ↗
Referência
CVE-2026-109937
CVE-2026-109937MEDIUM
Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block
33RISK
open ↗
Referência
CVE-2026-97394
CVE-2026-97394HIGH
kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
41RISK
open ↗
Referência
CVE-2015-7707
CVE-2015-7707—
Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter
23RISK
open ↗
Referência
CVE-2015-7768
CVE-2015-7768—
Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code via a long CWD comma
50RISK
open ↗
Referência
CVE-2015-7808
CVE-2015-7808—
The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PH
60RISK
open ↗
Referência
CVE-2026-89235
CVE-2026-89235MEDIUM
Testimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQLi via 'offset' Parameter
33RISK
open ↗
Referência
CVE-2026-97331
CVE-2026-97331MEDIUM
User Private Files < 2.1.9 - Subscriber+ User Email Address Disclosure via dpk_upvf_rmv_access
33RISK
open ↗
Referência
CVE-2026-97188
CVE-2026-97188HIGH
String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor
41RISK
open ↗
Referência
CVE-2026-105384
CVE-2026-105384MEDIUM
UNION HospitalManagementSystem patient_info.php sql injection
33RISK
open ↗
Referência
CVE-2026-105291
CVE-2026-105291MEDIUM
feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting
33RISK
open ↗
Referência
CVE-2026-105229
CVE-2026-105229MEDIUM
kishor-23 food-waste-management-system User Registration Endpoint signup.php sql injection
33RISK
open ↗
Referência
Genexis Platinum 4410 Router 2.1 - UPnP Credential Exposure
CVE-2020-25988—remotehardware
UPNP Service listening on port 5555 in Genexis Platinum 4410 Router V2.1 (P4410-V2–1.34H) has an action 'X_GetAccess' wh
23RISK
open ↗
Referência
CVE-2015-8430
CVE-2015-8430—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and
35RISK
open ↗
Referência
CVE-2026-105181
CVE-2026-105181MEDIUM
itsourcecode Online Admission System register1.php sql injection
33RISK
open ↗
Referência
CVE-2026-105180
CVE-2026-105180MEDIUM
Jeebase UserService info updateUser dynamically-determined object attributes
33RISK
open ↗
Referência
CVE-2026-104611
CVE-2026-104611CRITICAL
Tenda AC9 POST Request fast_setting_internet_set stack-based overflow
48RISK
open ↗
Referência
CVE-2026-104610
CVE-2026-104610CRITICAL
Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow
48RISK
open ↗
Referência
CVE-2026-90987
CVE-2026-90987MEDIUM
Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price
33RISK
open ↗
Referência
CVE-2026-85005
CVE-2026-85005MEDIUM
Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization
33RISK
open ↗
Referência
CVE-2026-84740
CVE-2026-84740MEDIUM
The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter
33RISK
open ↗
Referência
CVE-2026-79618
CVE-2026-79618MEDIUM
WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form
33RISK
open ↗
Referência
CVE-2026-1661
CVE-2026-1661MEDIUM
WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection
33RISK
open ↗
← previouspage 862 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.