Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,401cataloged exploits
35,511CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,332GitHub PoC 14,209VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
22,332 exploits
Referência
Joomla! Component Saxum Astro 4.0.14 - SQL Injection
SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla! via the publicid parameter.
23RISK
open ↗Referência
CVE-2018-7841
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code
100RISK
open ↗Referência
CVE-2026-14619
itsourcecode Hospital Management System medicine.php sql injection
33RISK
open ↗Referência
CVE-2026-1606
Improper Control of Generation of Code ('Code Injection') in GitLab
33RISK
open ↗Referência
CVE-2026-10749
Post Duplicator < 3.0.15 - Contributor+ PHP Object Injection via customMetaData
41RISK
open ↗Referência
CVE-2026-10735
ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server
41RISK
open ↗Referência
CVE-2026-10531
AI Share & Summarize < 2.0.4 - Contributor+ Stored XSS via title_style Shortcode Attribute
33RISK
open ↗Referência
CVE-2026-56115
Bootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass
41RISK
open ↗Referência
CVE-2026-4259
Ultimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_manage_auctions
41RISK
open ↗Referência
CVE-2026-4110
Ultimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_auctions_bids_list
33RISK
open ↗Referência
CVE-2026-10530
Pie Register < 3.8.4.10 - Unauthenticated Email Verification Bypass via Predictable Token
33RISK
open ↗Referência
CVE-2026-13592
liftoff-sr CIPster EtherNet IP Message append out-of-bounds write
33RISK
open ↗Referência
CVE-2026-13591
DeepMyst Mysti Contact Tracking ChannelBridge.ts _isTrackedConversation improper authorization
28RISK
open ↗Referência
CVE-2026-13590
seladb PcapPlusPlus Modbus Protocol ModbusLayer.h getLength heap-based overflow
33RISK
open ↗Referência
CVE-2026-13589
seladb PcapPlusPlus Telnet Subnegotiation Packet TelnetLayer.cpp getSubCommand heap-based overflow
33RISK
open ↗Referência
CVE-2026-34112
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac.php
48RISK
open ↗Referência
CVE-2026-13588
seladb PcapPlusPlus TLS Hello SSLHandshake.cpp getHandshakeVersion heap-based overflow
33RISK
open ↗Referência
CVE-2026-13587
seladb PcapPlusPlus LightPcapNg light_pcapng.c parse_by_block_type heap-based overflow
33RISK
open ↗Referência
CVE-2018-8065
An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24. There is a user mode write access v
60RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.