Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-102363
mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number
33RISK
open ↗Referência
CVE-2026-100313
mathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting
33RISK
open ↗Referência
CVE-2026-100312
mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection
33RISK
open ↗Referência
CVE-2026-94097
Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection
48RISK
open ↗Referência
CVE-2026-93973
SourceCodester Online Reviewer Management System btn_functions.php remove sql injection
33RISK
open ↗Referência
CVE-2026-73698
FileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action
41RISK
open ↗Referência
CVE-2026-73694
FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition
41RISK
open ↗Referência
CVE-2004-1580
SQL injection vulnerability in index.php in CubeCart 2.0.1 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência
CVE-2026-123032
OpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authentication
33RISK
open ↗Referência
CVE-2026-92800
Docs before 5.4.1 Stale Collaboration Session After Access Revocation
41RISK
open ↗Referência
CVE-2026-89262
MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check
41RISK
open ↗Referência
CVE-2026-86301
code-projects Hospital Information System Patient Management editPatient.php cross site scripting
33RISK
open ↗Referência
CVE-2026-86300
Tenda AC9 Web Management R7WebsSecurityHandler improper authentication
33RISK
open ↗Referência
CVE-2026-86272
Beijing Meite Software Technology U+Smart Enjoyment WebSite UploadFormImg.ashx unrestricted upload
33RISK
open ↗Referência
CVE-2026-86270
itsourcecode Sales and Inventory System settings_edit.php sql injection
33RISK
open ↗Referência
CVE-2026-123675
OpenBMB Internet of Agents Code Executor Tool code_executor.py execute_code code injection
33RISK
open ↗Referência
CVE-2026-110532
Mail Mage <= 0.0.25 - Unauthenticated SQLi via 'ewp_unsubscribe' Parameter
41RISK
open ↗Referência
CVE-2026-123269
libyal libvmdk Descriptor File libvmdk_descriptor_file.c libvmdk_descriptor_file_read_header out-of-bounds
33RISK
open ↗Referência
CVE-2026-123268
libyal libvmdk Extent Data File libvmdk_extent_table.c libvmdk_extent_table_get_extent_data_file_path memory corruption
33RISK
open ↗Referência
CVE-2026-123024
agentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authentication
33RISK
open ↗Referência
CVE-2026-123023
agentscope-ai AgentScope Bash Tool _bash.py check_permissions authorization
33RISK
open ↗Referência
CVE-2026-123022
agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injection
33RISK
open ↗Referência
CVE-2026-123020
eosphoros-ai DB-GPT Jinja2 Template __init__.py FileBasedSkill.get_prompt special elements in template engine
33RISK
open ↗Referência
CVE-2026-123019
eosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphere
33RISK
open ↗Referência
CVE-2026-123018
eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.