Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,151cataloged exploits
35,370CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,233GitHub PoC 14,119VulnCheck XDB 8,617Nuclei 4,257Metasploit 3,474✓ verified onlyrecentpopularrisk
22,232 exploits
Referência
CVE-2026-41460
CVE-2026-41460CRITICAL
SocialEngine <= 7.8.0 SQL Injection via activity/index/get-memberall
48RISK
open ↗
Referência
CVE-2026-4512
CVE-2026-4512LOW
WP reCaptcha by WebDesignBy < 2.0 – Admin+ Stored XSS
28RISK
open ↗
Referência
CVE-2026-4106
CVE-2026-4106MEDIUM
HT Mega < 3.0.7 – Unauthenticated PII Disclosure
48RISK
open ↗
Referência
CVE-2026-6878
CVE-2026-6878MEDIUM
ByteDance verl grader.py math_equal sandbox
33RISK
open ↗
Referência
CVE-2026-6874
CVE-2026-6874MEDIUM
ericc-ch copilot-api Header token dns rebinding
33RISK
open ↗
Referência
CVE-2026-40517
CVE-2026-40517HIGH
radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names
41RISK
open ↗
Referência
CVE-2026-34413
CVE-2026-34413HIGH
Xerte Online Toolkits Missing Authentication via connector.php
56RISK
open ↗
Referência
CVE-2026-34415
CVE-2026-34415CRITICAL
Xerte Online Toolkits File Upload RCE via elfinder Connector
63RISK
open ↗
Referência✓ VexDay Proof
Absolute NewsLetter 6.1 - Insecure Cookie Handling
CVE-2008-6861—webappsphp
Xigla Software Absolute Newsletter 6.0 and 6.1 allows remote attackers to bypass authentication and gain administrative
23RISK
open ↗
Referência✓ VexDay Proof
Absolute Content Rotator 6.0 - Insecure Cookie Handling
CVE-2008-6862—webappsphp
Absolute Content Rotator 6.0 allows remote attackers to bypass authentication and gain administrative access by setting
23RISK
open ↗
Referência✓ VexDay Proof
Absolute Live Support 5.1 - Insecure Cookie Handling
CVE-2008-6864—webappsphp
Xigla Software Absolute Live Support .NET 5.1 allows remote attackers to bypass authentication and gain administrative a
23RISK
open ↗
Referência✓ VexDay Proof
merlix educate servert - Authentication Bypass / File Disclosure
CVE-2008-6870—webappsasp
Merlix Educate Server allows remote attackers to bypass intended security restrictions and obtain sensitive information
23RISK
open ↗
Referência✓ VexDay Proof
merlix educate servert - Authentication Bypass / File Disclosure
CVE-2008-6871—webappsasp
Merlix Educate Server stores db.mdb under the web root with insufficient access control, which allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
Active Web Mail 4 - Blind SQL Injection
CVE-2008-6873—webappsasp
SQL injection vulnerability in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL commands via the Tab
23RISK
open ↗
Referência✓ VexDay Proof
ASPSiteWare Automotive Dealer 1.0/2.0 - SQL Injection
CVE-2008-6874—webappsphp
Multiple SQL injection vulnerabilities in ASP SiteWare autoDealer 1 and 2 allow remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2010-4721
CVE-2010-4721—
SQL injection vulnerability in news.php in Immo Makler allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência
CVE-2017-9810
CVE-2017-9810—
There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Mai
23RISK
open ↗
Referência
CVE-2017-9810
CVE-2017-9810—
There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Mai
23RISK
open ↗
Referência
CVE-2017-9822
CVE-2017-9822HIGHunder attackransomware
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code e
100RISK
open ↗
Referência
CVE-2026-7214
CVE-2026-7214MEDIUM
eghuzefa engineer-your-data server.py file_inf path traversal
33RISK
open ↗
Referência
CVE-2026-7213
CVE-2026-7213MEDIUM
ef10007 MLOps_MCP save_file Tool fastmcp_server.py path traversal
33RISK
open ↗
Referência
CVE-2026-7212
CVE-2026-7212MEDIUM
edvardlindelof notes-mcp notes_mcp.py path traversal
33RISK
open ↗
Referência
CVE-2026-7211
CVE-2026-7211MEDIUM
dvladimirov MCP Git Search API mcp_server.py GitSearchRequest command injection
33RISK
open ↗
Referência
CVE-2026-7206
CVE-2026-7206MEDIUM
dubydu sqlite-mcp entry.py extract_to_json sql injection
33RISK
open ↗
Referência
CVE-2026-7205
CVE-2026-7205MEDIUM
duartium papers-mcp-server main.py search_papers path traversal
33RISK
open ↗
Referência
CVE-2026-7204
CVE-2026-7204CRITICAL
Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection
48RISK
open ↗
Referência
CVE-2026-7203
CVE-2026-7203CRITICAL
Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection
48RISK
open ↗
Referência
CVE-2026-38651
CVE-2026-38651HIGH
Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jw
41RISK
open ↗
Referência
CVE-2026-7202
CVE-2026-7202CRITICAL
Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection
48RISK
open ↗
Referência
CVE-2026-7146
CVE-2026-7146MEDIUM
AlejandroArciniegas mcp-data-vis HTTP Request server.js axios server-side request forgery
33RISK
open ↗
← previouspage 420 / 742next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.