Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,401cataloged exploits
35,511CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,332GitHub PoC 14,209VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
22,332 exploits
Referência
Craft CMS 3.1.12 Pro - Cross-Site Scripting
CVE-2019-9554—webappsphp
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at
23RISK
open ↗
Referência
CVE-2019-9581
CVE-2019-9581—
phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitra
28RISK
open ↗
Referência
CVE-2026-9426
CVE-2026-9426HIGH
Edimax EW-7438RPn formHwSet stack-based overflow
41RISK
open ↗
Referência
CVE-2026-9416
CVE-2026-9416MEDIUM
code-projects Employee Management System myprofile.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-9415
CVE-2026-9415MEDIUM
code-projects Employee Management System eloginwel.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-9413
CVE-2026-9413MEDIUM
SourceCodester Indian Invoicing System category.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-9412
CVE-2026-9412MEDIUM
SourceCodester Indian Invoicing System Backend Endpoint access control
33RISK
open ↗
Referência✓ VexDay Proof
ApowerManager 3.1.7 - Phone Manager Remote Denial of Service (PoC)
CVE-2019-9601—dosandroid
The ApowerManager application through 3.1.7 for Android allows remote attackers to cause a denial of service via many si
23RISK
open ↗
Referência
CVE-2026-9411
CVE-2026-9411MEDIUM
SourceCodester Indian Invoicing System Invoice Generation IGST_Invoice.php sql injection
33RISK
open ↗
Referência
CVE-2026-9410
CVE-2026-9410MEDIUM
Sushmi-pal Invoice-System Profile Workflow profile improper authorization
33RISK
open ↗
Referência
CVE-2026-9409
CVE-2026-9409MEDIUM
Sushmi-pal Invoice-System User Management user improper authorization
33RISK
open ↗
Referência
CVE-2026-9407
CVE-2026-9407CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection
48RISK
open ↗
Referência
CVE-2026-9406
CVE-2026-9406CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection
48RISK
open ↗
Referência
eBrigade ERP 4.5 - Arbitrary File Download
CVE-2019-9622—webappsphp
eBrigade through 4.5 allows Arbitrary File Download via ../ directory traversal in the showfile.php file parameter, as d
23RISK
open ↗
Referência
CVE-2019-9670
CVE-2019-9670CRITICALunder attack
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XX
100RISK
open ↗
Referência
CVE-2019-9670
CVE-2019-9670CRITICALunder attack
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XX
100RISK
open ↗
Referência
CVE-2026-14300
CVE-2026-14300HIGH
miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover
41RISK
open ↗
Referência
CVE-2026-14234
CVE-2026-14234HIGH
WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF
41RISK
open ↗
Referência
CVE-2026-14224
CVE-2026-14224MEDIUM
Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR
33RISK
open ↗
Referência
CVE-2026-13692
CVE-2026-13692MEDIUM
PayU CommercePro < 3.9.0 - Unauthenticated Order Tampering
33RISK
open ↗
Referência
CVE-2019-9881
CVE-2019-9881—
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on
43RISK
open ↗
Referência
CVE-2019-9978
CVE-2019-9978MEDIUMunder attack
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio
100RISK
open ↗
Referência
CVE-2020-0009
CVE-2020-0009—
In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This
23RISK
open ↗
Referência
CVE-2018-25342
CVE-2018-25342HIGH
Smartshop 1 SQL Injection via search.php
41RISK
open ↗
Referência
CVE-2018-25341
CVE-2018-25341HIGH
Smartshop 1 SQL Injection via product.php id Parameter
41RISK
open ↗
Referência
CVE-2020-0646
CVE-2020-0646CRITICALunder attack
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.N
100RISK
open ↗
Referência
CVE-2020-0674
CVE-2020-0674HIGHunder attack
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet
93RISK
open ↗
Referência
CVE-2020-0688
CVE-2020-0688HIGHunder attackransomware
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle o
100RISK
open ↗
Referência
CVE-2020-0688
CVE-2020-0688HIGHunder attackransomware
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle o
100RISK
open ↗
Referência
CVE-2020-0796
CVE-2020-0796CRITICALunder attackransomware
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h
100RISK
open ↗
← previouspage 492 / 745next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.