Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,302cataloged exploits
35,469CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,301GitHub PoC 14,141VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
22,266 exploits
Referência
CVE-2026-5639
CVE-2026-5639MEDIUM
PHPGurukul Online Shopping Portal Project Parameter update-image3.php sql injection
33RISK
open ↗
Referência
CVE-2026-5638
CVE-2026-5638MEDIUM
HerikLyma CPPWebFramework path traversal
33RISK
open ↗
Referência
CVE-2026-14733
CVE-2026-14733MEDIUM
SourceCodester Class and Exam Timetabling System edit_coursea.php sql injection
33RISK
open ↗
Referência
CVE-2018-18322
CVE-2018-18322—
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/ind
28RISK
open ↗
Referência
CVE-2018-18325
CVE-2018-18325HIGHunder attack
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue ex
100RISK
open ↗
Referência
CVE-2018-18326
CVE-2018-18326—
DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expect
50RISK
open ↗
Referência
CVE-2018-18416
CVE-2018-18416—
LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the site_name par
23RISK
open ↗
Referência
CVE-2018-18416
CVE-2018-18416—
LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the site_name par
23RISK
open ↗
Referência
CVE-2018-18417
CVE-2018-18417—
In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as d
23RISK
open ↗
Referência
CVE-2026-5044
CVE-2026-5044HIGH
Belkin F9K1122 Setting formSetSystemSettings stack-based overflow
41RISK
open ↗
Referência
CVE-2026-5043
CVE-2026-5043HIGH
Belkin F9K1122 Parameter formSetPassword stack-based overflow
41RISK
open ↗
Referência
CVE-2026-5042
CVE-2026-5042HIGH
Belkin F9K1122 Parameter formCrossBandSwitch stack-based overflow
41RISK
open ↗
Referência
CVE-2026-5041
CVE-2026-5041MEDIUM
code-projects Chamber of Commerce Membership Management System pageMail.php fwrite command injection
33RISK
open ↗
Referência
CVE-2026-5037
CVE-2026-5037MEDIUM
mxml mxmlIndexNew mxml-index.c index_sort stack-based overflow
33RISK
open ↗
Referência
CVE-2026-5036
CVE-2026-5036HIGH
Tenda 4G06 Endpoint DhcpListClient fromDhcpListClient stack-based overflow
41RISK
open ↗
Referência
CVE-2026-5035
CVE-2026-5035MEDIUM
code-projects Accounting System Parameter view_work.php sql injection
33RISK
open ↗
Referência
CVE-2026-5034
CVE-2026-5034MEDIUM
code-projects Accounting System Parameter edit_costumer.php sql injection
33RISK
open ↗
Referência
CVE-2026-5033
CVE-2026-5033MEDIUM
code-projects Accounting System Parameter view_costumer.php sql injection
33RISK
open ↗
Referência
CVE-2026-5031
CVE-2026-5031MEDIUM
BichitroGan ISP Billing Software Endpoint users-view resource injection
33RISK
open ↗
Referência
CVE-2026-5030
CVE-2026-5030MEDIUM
Totolink NR1800X Telnet Service cstecgi.cgi NTPSyncWithHost command injection
33RISK
open ↗
Referência
CVE-2026-5024
CVE-2026-5024HIGH
D-Link DIR-513 formSetEmail stack-based overflow
41RISK
open ↗
Referência
CVE-2026-5023
CVE-2026-5023MEDIUM
DeDeveloper23 codebase-mcp RepoMix codebase.ts saveCodebase os command injection
33RISK
open ↗
Referência
CVE-2026-5021
CVE-2026-5021HIGH
Tenda F453 httpd PPTPUserSetting fromPPTPUserSetting stack-based overflow
41RISK
open ↗
Referência
CVE-2026-5020
CVE-2026-5020MEDIUM
Totolink A3600R Parameter cstecgi.cgi setNoticeCfg command injection
33RISK
open ↗
Referência
CVE-2026-5019
CVE-2026-5019MEDIUM
code-projects Simple Food Order System Parameter all-orders.php sql injection
33RISK
open ↗
Referência
CVE-2026-5018
CVE-2026-5018MEDIUM
code-projects Simple Food Order System Parameter register-router.php sql injection
33RISK
open ↗
Referência
CVE-2026-5017
CVE-2026-5017MEDIUM
code-projects Simple Food Order System Parameter all-tickets.php sql injection
33RISK
open ↗
Referência
CVE-2026-5016
CVE-2026-5016MEDIUM
elecV2 elecV2P URL mock eAxios server-side request forgery
33RISK
open ↗
Referência
CVE-2026-5015
CVE-2026-5015MEDIUM
elecV2 elecV2P Endpoint logs cross site scripting
33RISK
open ↗
Referência
CVE-2026-5014
CVE-2026-5014MEDIUM
elecV2 elecV2P Wildcard log path.join path traversal
33RISK
open ↗
← previouspage 457 / 743next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.