Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
75,445cataloged exploits
34,432CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,497GitHub PoC 13,627VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
21,493 exploits
Referência✓ VexDay Proof
NoAh 0.9 pre 1.2 - 'mfa_theme.php' Remote File Inclusion
PHP remote file inclusion vulnerability in modules/noevents/templates/mfa_theme.php in NoAh (aka PHP Content Architect,
23RISK
open ↗Referência✓ VexDay Proof
PHPtree 1.3 - 'cms2.php?s_dir' Remote File Inclusion
PHP remote file inclusion vulnerability in plugin/HP_DEV/cms2.php in PHPtree 1.3 allows remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
Archangel Weblog 0.90.02 - Local File Inclusion / Authentication Bypass
Directory traversal vulnerability in index.php in Archangel Weblog 0.90.02 allows remote attackers to read arbitrary fil
23RISK
open ↗Referência✓ VexDay Proof
aForum 1.32 - 'CommonAbsDir' Remote File Inclusion
PHP remote file inclusion vulnerability in common/func.php in aForum 1.32 and earlier allows remote attackers to execute
23RISK
open ↗Referência
CVE-2026-14802
react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injection
33RISK
open ↗Referência
CVE-2026-12083
Admin and Site Enhancements < 8.8.4 - Unauthenticated Administrator-Role Restoration via reset-for Parameter
41RISK
open ↗Referência
CVE-2026-11962
FileOrganizer < 1.2.0 - Authenticated Arbitrary File Upload via elFinder File Operations
41RISK
open ↗Referência
CVE-2026-11855
Simple Membership < 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API Version
41RISK
open ↗Referência
CVE-2026-11766
Ultimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile Fields
41RISK
open ↗Referência
CVE-2026-14798
CodeAstro Apartment Visitor Management System visitor-entry.php sql injection
33RISK
open ↗Referência
CVE-2026-14797
CodeAstro Apartment Visitor Management System edit-apartment.php sql injection
33RISK
open ↗Referência
CVE-2026-14796
CodeAstro Apartment Visitor Management System report.php sql injection
33RISK
open ↗Referência
CVE-2026-14795
CodeAstro Apartment Visitor Management System action-visitor.php sql injection
33RISK
open ↗Referência
CVE-2026-14774
itsourcecode Hospital Management System paymentdischarge.php sql injection
33RISK
open ↗Referência
CVE-2026-14773
itsourcecode Hospital Management System payment.php sql injection
33RISK
open ↗Referência
CVE-2026-14772
SourceCodester Class and Exam Timetabling System edit_course1.php sql injection
33RISK
open ↗Referência
CVE-2026-14771
SourceCodester Class and Exam Timetabling System edit_exam1.php sql injection
33RISK
open ↗Referência
CVE-2026-14770
SourceCodester Class and Exam Timetabling System edit_room.php sql injection
33RISK
open ↗Referência✓ VexDay Proof
telltarget 1.3.3 - 'tt_docroot' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in telltarget CMS 1.3.3 allow remote attackers to execute arbitrary P
28RISK
open ↗Referência✓ VexDay Proof
TutorialCMS 1.00 - 'search.php?search' SQL Injection
Multiple SQL injection vulnerabilities in TutorialCMS (aka Photoshop Tutorials) 1.00 and earlier allow remote attackers
23RISK
open ↗Referência✓ VexDay Proof
TutorialCMS 1.00 - 'search.php?search' SQL Injection
Multiple cross-site scripting (XSS) vulnerabilities in TutorialCMS (aka Photoshop Tutorials) 1.00 and earlier allow remo
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.