Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-114260
oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication
33RISK
open ↗Referência
CVE-2026-114259
oretnom23 file-management-system-php admin_class.php save_files unrestricted upload
33RISK
open ↗Referência
CVE-2026-114258
oretnom23 file-management-system-php File Management files.php sql injection
33RISK
open ↗Referência
CVE-2026-114257
oretnom23 file-management-system-php File Download download.php readfile sql injection
33RISK
open ↗Referência✓ VexDay Proof
Web Wiz Guestbook 8.21 - Database Disclosure
Web Wiz Guestbook 6.0 stores sensitive information under the web root with insufficient access control, which allows rem
23RISK
open ↗Referência
CVE-2026-102293
realjerrytang tacomall api-admin Backend ApiMaApplication.java OrgStaffServiceImpl.add improper authorization
33RISK
open ↗Referência
CVE-2026-101280
Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing
33RISK
open ↗Referência
CVE-2026-101279
Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow
33RISK
open ↗Referência
CVE-2026-101278
Trusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation
33RISK
open ↗Referência
CVE-2026-101071
Acrel Electric Unet Web Service Upload Endpoint upload unrestricted upload
33RISK
open ↗Referência
CVE-2026-101040
Ricoh SP 330DN/SP 221/SP C252SF/Aficio SP 3500SF HTTP Multipart Form-Data denial of service
41RISK
open ↗Referência
CVE-2026-101036
FLB-Music FLB-Music-Player createParsedTrack.ts path.join path traversal
33RISK
open ↗Referência
CVE-2026-89300
WP Verify API <= 1.0.0 - Unauthenticated Verification Code Email Sending to Arbitrary Recipients
33RISK
open ↗Referência
CVE-2026-89303
Post Voting System <= 1.0 - Subscriber+ SQLi via 'row' Parameter
33RISK
open ↗Referência
CVE-2026-101005
October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery
33RISK
open ↗Referência
CVE-2026-100909
OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery
33RISK
open ↗Referência
CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗Referência
CVE-2026-92399
GPAC WebSocket rmt_ws.c rmt_client_handle_ws_frame heap-based overflow
33RISK
open ↗Referência
CVE-2026-90705
D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection
33RISK
open ↗Referência
CVE-2025-68624
N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.