Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência✓ VexDay Proof
HP-UX 11i - 'swask' Format String Privilege Escalation
CVE-2006-5558—localhp-ux
Format string vulnerability in the swask command in HP-UX B.11.11 and possibly other versions allows local users to exec
23RISK
open ↗
Referência
CVE-2026-108967
CVE-2026-108967MEDIUM
SourceCodester Performance Indicator System edit_credit.php sql injection
33RISK
open ↗
Referência
CVE-2022-34668
CVE-2022-34668CRITICAL
NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage ma
53RISK
open ↗
Referência
CVE-2022-35919
CVE-2022-35919HIGH
Authenticated requests for server update admin API allows path traversal in minio
53RISK
open ↗
Referência✓ VexDay Proof
JV2 Folder Gallery 3.0 - 'download.php' Remote File Disclosure
CVE-2007-0329—webappsphp
download.php in Joonas Viljanen JV2 Folder Gallery allows remote attackers to read sensitive files via a relative pathna
23RISK
open ↗
Referência
CVE-2022-37061
CVE-2022-37061—
All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This
60RISK
open ↗
Referência
CVE-2026-89038
CVE-2026-89038MEDIUM
Verizon Cloud for Android < 26.7.10 Path Traversal via OneTouchUploadActivity
33RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows - '.png' IHDR Block Denial of Service (PoC) (2)
CVE-2006-7210—doswindows
Microsoft Windows 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (cpu consumption) via a
28RISK
open ↗
Referência
CVE-2026-91017
CVE-2026-91017LOW
Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback
28RISK
open ↗
Referência
CVE-2026-91019
CVE-2026-91019MEDIUM
Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure
33RISK
open ↗
Referência✓ VexDay Proof
ThWboard 3.0b2.84-php5 - SQL Injection / Code Execution
CVE-2007-0340—webappsphp
SQL injection vulnerability in inc/header.inc.php in ThWboard 3.0b2.84-php5 and earlier allows remote attackers to execu
23RISK
open ↗
Referência
CVE-2026-85128
CVE-2026-85128HIGH
Choose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escalation via Registration Role Request
41RISK
open ↗
Referência✓ VexDay Proof
Apple Mac OSX 10.4.8 - SLP Daemon Service Registration Buffer Overflow (PoC)
CVE-2007-0355—dososx
Buffer overflow in the Apple Minimal SLP v2 Service Agent (slpd) in Mac OS X 10.4.11 and earlier, including 10.4.8, allo
23RISK
open ↗
Referência✓ VexDay Proof
Uberghey 0.3.1 - 'FrontPage.php' Remote File Inclusion
CVE-2007-0359—webappsphp
PHP remote file inclusion vulnerability in frontpage.php in Uberghey CMS 0.3.1 allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
Oreon 1.2.3 RC4 - '/lang/index.php' Remote File Inclusion
CVE-2007-0360—webappsphp
PHP remote file inclusion vulnerability in lang/index.php in Oreon 1.2.3 RC4 and earlier allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2026-14236
CVE-2026-14236MEDIUM
Contact Form 7 – PayPal & Stripe Add-on < 2.5 - Open Redirect
33RISK
open ↗
Referência
CVE-2026-14203
CVE-2026-14203MEDIUM
Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title
33RISK
open ↗
Referência
CVE-2026-90857
CVE-2026-90857MEDIUM
SourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted upload
33RISK
open ↗
Referência
CVE-2026-90942
CVE-2026-90942CRITICAL
Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints
48RISK
open ↗
Referência
CVE-2026-82019
CVE-2026-82019LOW
TripleLift video-bundle.js DOM-based XSS via postMessage
28RISK
open ↗
Referência
CVE-2026-90713
CVE-2026-90713MEDIUM
vllm-project vLLM tiktoken vocab File mod.rs new denial of service
33RISK
open ↗
Referência
CVE-2026-90579
CVE-2026-90579MEDIUM
cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication
33RISK
open ↗
Referência
CVE-2026-90577
CVE-2026-90577MEDIUM
GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based overflow
33RISK
open ↗
Referência
CVE-2026-90566
CVE-2026-90566MEDIUM
Rizwan17 inventory-management-system Registration register.php createUserAccount improper authorization
33RISK
open ↗
Referência
CVE-2026-90565
CVE-2026-90565MEDIUM
Rizwan17 inventory-management-system dashboard.php access control
33RISK
open ↗
Referência
CVE-2026-114577
CVE-2026-114577MEDIUM
oretnom23 php-travel-agency-system Insertion insert.php sql injection
33RISK
open ↗
Referência
CVE-2026-114266
CVE-2026-114266MEDIUM
ProjectWorlds Advanced Library Management System profile.php mysqli_query sql injection
33RISK
open ↗
Referência
CVE-2026-114265
CVE-2026-114265MEDIUM
ProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injection
33RISK
open ↗
Referência
CVE-2026-90525
CVE-2026-90525MEDIUM
itsourcecode Sales and Inventory System cust_pos_trans.php sql injection
33RISK
open ↗
Referência
CVE-2026-90522
CVE-2026-90522MEDIUM
jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recovery
33RISK
open ↗
← previouspage 870 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.