Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,542cataloged exploits
34,971CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,899GitHub PoC 13,947VulnCheck XDB 8,542Nuclei 4,243Metasploit 3,468✓ verified onlyrecentpopularrisk
21,899 exploits
Referência✓ VexDay Proof
Ay System CMS 2.6 - 'main.php' Remote File Inclusion
CVE-2006-4440—webappsphp
PHP remote file inclusion vulnerability in main.php in Ay System Solutions CMS 2.6 and earlier allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
Interact 2.2 - 'CONFIG[base_path]' Remote File Inclusion
CVE-2006-4448—webappsphp
Multiple PHP remote file inclusion vulnerabilities in interact 2.2, when register_globals is enabled, allow remote attac
23RISK
open ↗
Referência✓ VexDay Proof
XChat 2.6.7 (Windows) - Remote Denial of Service
CVE-2006-4455—doswindows
Unspecified vulnerability in Xchat 2.6.7 and earlier allows remote attackers to cause a denial of service (crash) via un
23RISK
open ↗
Referência
CVE-2026-13559
CVE-2026-13559MEDIUM
code-projects Real State Services single-list_sale.php add sql injection
33RISK
open ↗
Referência
CVE-2026-57521
CVE-2026-57521MEDIUM
Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController
33RISK
open ↗
Referência
CVE-2026-56774
CVE-2026-56774MEDIUM
Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID
33RISK
open ↗
Referência
CVE-2026-56770
CVE-2026-56770HIGH
libais 0.15 - Out-of-bounds Vector Access in VdmStream::AddLine via Invalid Sequential Message ID
41RISK
open ↗
Referência
CVE-2026-56769
CVE-2026-56769MEDIUM
Huly Platform - Server-Side Request Forgery via /import Endpoint
33RISK
open ↗
Referência
CVE-2026-12183
CVE-2026-12183CRITICAL
Nefteprodukttekhnika BUK TS-G Gas Station Automation System Authentication Bypass via ajax-login.php Accepting Arbitrary Credentials
48RISK
open ↗
Referência
CVE-2026-9062
CVE-2026-9062LOW
Agile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path Traversal
28RISK
open ↗
Referência
CVE-2026-12066
CVE-2026-12066MEDIUM
PbootCMS Password MemberController.php retrieve password recovery
33RISK
open ↗
Referência
CVE-2026-12065
CVE-2026-12065LOW
Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme
28RISK
open ↗
Referência
CVE-2026-12065
CVE-2026-12065LOW
Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme
28RISK
open ↗
Referência
CVE-2026-8589
CVE-2026-8589HIGH
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
41RISK
open ↗
Referência
CVE-2026-20253
CVE-2026-20253CRITICALunder attack
Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
100RISK
open ↗
Referência
CVE-2026-25860
CVE-2026-25860MEDIUM
OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler
33RISK
open ↗
Referência
CVE-2026-25860 POC git
CVE-2026-25860MEDIUM
OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler
33RISK
open ↗
Referência
CVE-2026-34417
CVE-2026-34417MEDIUM
OSCAL-GUI Reflected XSS via project parameter in oscal-forms.php
33RISK
open ↗
Referência
CVE-2026-34416
CVE-2026-34416MEDIUM
OSCAL-GUI Reflected XSS via project parameter in oscal.php
33RISK
open ↗
Referência
CVE-2017-20250
CVE-2017-20250HIGH
WordPress Plugin Mac Photo Gallery 3.0 Arbitrary File Download
41RISK
open ↗
Referência
CVE-2025-55651
CVE-2025-55651MEDIUM
A NULL pointer dereference in the gf_isom_get_user_data_count function (isomedia/isom_read.c) of GPAC MP4Box v2.4 allows
33RISK
open ↗
Referência
CVE-2026-11582
CVE-2026-11582MEDIUM
CodeAstro Student Attendance Management System index.php sql injection
33RISK
open ↗
Referência
CVE-2026-11559
CVE-2026-11559MEDIUM
CodeAstro Payroll System view_account.php sql injection
33RISK
open ↗
Referência
CVE-2026-25555
CVE-2026-25555CRITICAL
OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header
63RISK
open ↗
Referência
CVE-2021-22005
CVE-2021-22005CRITICALunder attackransomware
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with netw
100RISK
open ↗
Referência
CVE-2017-8484
CVE-2017-8484—
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2,
23RISK
open ↗
Referência
CVE-2020-5902
CVE-2020-5902CRITICALunder attackransomware
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic
100RISK
open ↗
Referência
CVE-2026-10616
CVE-2026-10616MEDIUM
nextlevelbuilder GoClaw Team Task Completion team_tasks_lifecycle.go TeamTasksTool.executeComplete authorization
33RISK
open ↗
Referência
CVE-2026-10297
CVE-2026-10297MEDIUM
itsourcecode Fees Management System manage_course.php sql injection
33RISK
open ↗
Referência
CVE-2026-10296
CVE-2026-10296MEDIUM
itsourcecode Fees Management System ajax.php sql injection
33RISK
open ↗
← previouspage 333 / 730next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.