Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-100880
CVE-2026-100880MEDIUM
zhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scripting
33RISK
open ↗
Referência
CVE-2026-100876
CVE-2026-100876MEDIUM
mathurvishal CloudClassroom-PHP-Project loginlinkstudent.php missing authentication
33RISK
open ↗
Referência
WinWaste.NET 1.0.6183.16475 - Privilege Escalation due Incorrect Access Control
CVE-2021-34110—localwindows
WinWaste.NET version 1.0.6183.16475 has incorrect permissions, allowing a local unprivileged user to replace the executa
23RISK
open ↗
Referência
CVE-2021-35312
CVE-2021-35312—
A vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable "RemoteBackup.Serv
23RISK
open ↗
Referência
CVE-2016-8855
CVE-2016-8855—
Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experience
23RISK
open ↗
Referência
CVE-2017-0072
CVE-2017-0072—
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers
35RISK
open ↗
Referência
CVE-2026-84097
CVE-2026-84097MEDIUM
WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter
33RISK
open ↗
Referência
CVE-2026-19708
CVE-2026-19708MEDIUM
File Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup Disclosure
33RISK
open ↗
Referência
CVE-2026-16591
CVE-2026-16591HIGH
WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields
41RISK
open ↗
Referência
CVE-2026-11871
CVE-2026-11871MEDIUM
Team Showcase Supreme < 9.3 - Unauthenticated Sensitive Data Disclosure via wpm_6310_team_member_details
33RISK
open ↗
Referência
CVE-2026-100310
CVE-2026-100310HIGH
GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX
41RISK
open ↗
Referência
CVE-2026-100306
CVE-2026-100306MEDIUM
TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement
33RISK
open ↗
Referência
CVE-2026-100305
CVE-2026-100305MEDIUM
TDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission Endpoint
33RISK
open ↗
Referência
CVE-2026-97878
CVE-2026-97878MEDIUM
zhistaredu StarTraining Druid Console index.html anonymous missing authentication
33RISK
open ↗
Referência
CVE-2026-78397
CVE-2026-78397MEDIUM
Link Library < 7.9.6 - Unauthenticated SSRF via Reciprocal Link Validation
33RISK
open ↗
Referência
CVE-2026-97721
CVE-2026-97721MEDIUM
Sanluan PublicCMS exportExcel/exportData SysUserAdminController.java CmsContentAdminController authorization
33RISK
open ↗
Referência
CVE-2026-97360
CVE-2026-97360CRITICAL
HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine
48RISK
open ↗
Referência
OpenSIS 8.0 'modname' - Directory Traversal
CVE-2021-40651—webappsphp
OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), wh
43RISK
open ↗
Referência
CVE-2021-41318
CVE-2021-41318—
In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input.
23RISK
open ↗
Referência
CVE-2026-108671
CVE-2026-108671HIGH
JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryById
41RISK
open ↗
Referência
CVE-2026-94256
CVE-2026-94256HIGH
SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP
41RISK
open ↗
Referência
CVE-2026-96530
CVE-2026-96530MEDIUM
Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget
33RISK
open ↗
Referência
CVE-2026-13413
CVE-2026-13413MEDIUM
CMP - Coming Soon & Maintenance < 4.1.20 - Unauthenticated Maintenance Mode Bypass via Login URL Match
33RISK
open ↗
Referência
CVE-2026-103690
CVE-2026-103690MEDIUM
itsourcecode Leave Management System controller.php sql injection
33RISK
open ↗
Referência
CVE-2026-96200
CVE-2026-96200MEDIUM
Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback
33RISK
open ↗
Referência
CVE-2026-87973
CVE-2026-87973LOW
If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name
28RISK
open ↗
Referência
CVE-2026-101146
CVE-2026-101146MEDIUM
Eleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAudit information disclosure
33RISK
open ↗
Referência
CVE-2026-101145
CVE-2026-101145MEDIUM
Eleveo Call Recording Software User Management userAddAction.do ldap injection
33RISK
open ↗
Referência
CVE-2026-101144
CVE-2026-101144MEDIUM
Eleveo Call Recording Software Query Builder searchAction.do access control
33RISK
open ↗
Referência
CVE-2026-90978
CVE-2026-90978HIGH
Filter Gallery < 1.1.5 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce Check
41RISK
open ↗
← previouspage 868 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.