Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-94151
Omega Solution HRM OS Role Permission API permission missing authentication
33RISK
open ↗Referência
CVE-2026-94149
Omega Solution HRM OS Role Permission Retrieval Endpoint permission resource injection
33RISK
open ↗Referência
CVE-2026-85017
Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection
41RISK
open ↗Referência
CVE-2026-84223
Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload
33RISK
open ↗Referência
CVE-2026-81652
NextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR
28RISK
open ↗Referência
CVE-2017-17576
FS Gigs Script 1.0 has SQL Injection via the browse-category.php cat parameter, browse-scategory.php sc parameter, or se
23RISK
open ↗Referência
CVE-2017-17580
FS Linkedin Clone 1.0 has SQL Injection via the group.php grid parameter, profile.php fid parameter, or company_details.
23RISK
open ↗Referência
CVE-2026-92815
changedetection.io through 0.60.6 SSRF via browser-step Goto URL
41RISK
open ↗Referência
CVE-2026-92806
phpList before 3.6.17 Cross-Site Request Forgery via massremove.php
41RISK
open ↗Referência
CVE-2026-92466
microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking
41RISK
open ↗Referência
CVE-2026-92462
yshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStep
41RISK
open ↗Referência
CVE-2026-76558
WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names
33RISK
open ↗Referência
CVE-2026-91997
evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass
33RISK
open ↗Referência
CVE-2017-17645
Bus Booking Script 1.0 has SQL Injection via the txtname parameter to admin/index.php.
23RISK
open ↗Referência
CVE-2026-82702
Edimax BR-6214K asp_WlanMP Endpoint wlanMP.asp system os command injection
33RISK
open ↗Referência
CVE-2026-82701
code-projects Online Shopping System Search Functionality action.php sql injection
33RISK
open ↗Referência
CVE-2026-12513
Shared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path Traversal
33RISK
open ↗Referência
CVE-2026-82090
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alt
48RISK
open ↗Referência
CVE-2026-78139
Notifima < 3.1.4 - Subscriber+ Stock Alert Unsubscription via IDOR
33RISK
open ↗Referência
CVE-2026-76070
Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Password Parameter
48RISK
open ↗Referência
CVE-2026-76049
SourceCodester Simple Online Food Ordering System ajax.php save_menu sql injection
33RISK
open ↗Referência
CVE-2026-76048
SourceCodester Simple Online Food Ordering System ajax.php login sql injection
33RISK
open ↗Referência
CVE-2026-19792
Tenda G0 httpd web management interface module setPortMapping buffer overflow
41RISK
open ↗Referência
CVE-2026-19791
Tenda G0 httpd web management interface module addStaticRoute stack-based overflow
41RISK
open ↗Referência
CVE-2026-19790
Tenda G0 httpd Web Management module formSetPortMirror stack-based overflow
41RISK
open ↗Referência
CVE-2026-16965
Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.