Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,401cataloged exploits
35,511CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,332GitHub PoC 14,209VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
22,332 exploits
Referência
CVE-2026-15471
Eleveo Call Recording Software pci_dss_status.jsp improper authorization
33RISK
open ↗Referência
CVE-2026-16073
AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross site scripting
33RISK
open ↗Referência
CVE-2026-63093
Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace
41RISK
open ↗Referência
CVE-2026-11966
User Registration & Membership < 5.2.3 - Unauthenticated Limited User Deletion via Stripe Subscription Handler
33RISK
open ↗Referência
CVE-2026-11961
User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID
41RISK
open ↗Referência
CVE-2026-11575
PhonePe Payment Solutions < 3.1.0 - Unauthenticated Payment Bypass via Forged Callback
41RISK
open ↗Referência
CVE-2026-10525
NEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form Submission
33RISK
open ↗Referência
CVE-2026-12492
Happy Coders OTP Login for WooCommerce < 2.8 - Unauthenticated Account Takeover via hcotp_auto_login_user
48RISK
open ↗Referência
CVE-2026-12395
WP Job Portal < 2.5.5 - Subscriber+ SQL Injection via Applied Resumes 'ta' Parameter
33RISK
open ↗Referência
CVE-2026-7823
Totolink A8000RU cstecgi.cgi setAppFilterCfg os command injection
48RISK
open ↗Referência
CVE-2026-7822
itsourcecode Courier Management System print_pdets.php sql injection
33RISK
open ↗Referência
CVE-2026-7812
54yyyu code-mcp MCP Tool server.py git_operation command injection
33RISK
open ↗Referência
CVE-2026-7725
PrefectHQ prefect GitRepository Pull storage.py argument injection
33RISK
open ↗Referência
CVE-2026-7724
PrefectHQ prefect Webhook/Notification validate_restricted_url toctou
28RISK
open ↗Referência
CVE-2020-6519
Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy
28RISK
open ↗Referência
CVE-2019-2729
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
85RISK
open ↗Referência
CVE-2019-3396
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from vers
100RISK
open ↗Referência
CVE-2019-3396
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from vers
100RISK
open ↗Referência
CVE-2026-34115
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe_amazon.php
48RISK
open ↗Referência
CVE-2026-11794
Advanced Form Integration < 2.1.1 - Unauthenticated Privilege Escalation via Breakdance Form Role Mapping
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.