Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,401cataloged exploits
35,511CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,332GitHub PoC 14,209VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
22,332 exploits
Referência
eBrigade ERP 4.5 - Arbitrary File Download
CVE-2019-9622—webappsphp
eBrigade through 4.5 allows Arbitrary File Download via ../ directory traversal in the showfile.php file parameter, as d
23RISK
open ↗
Referência
CVE-2019-9670
CVE-2019-9670CRITICALunder attack
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XX
100RISK
open ↗
Referência
CVE-2019-9670
CVE-2019-9670CRITICALunder attack
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XX
100RISK
open ↗
Referência
CVE-2026-14300
CVE-2026-14300HIGH
miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover
41RISK
open ↗
Referência
CVE-2026-14234
CVE-2026-14234HIGH
WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF
41RISK
open ↗
Referência
CVE-2026-14224
CVE-2026-14224MEDIUM
Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR
33RISK
open ↗
Referência
CVE-2026-13692
CVE-2026-13692MEDIUM
PayU CommercePro < 3.9.0 - Unauthenticated Order Tampering
33RISK
open ↗
Referência
CVE-2019-9881
CVE-2019-9881—
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on
43RISK
open ↗
Referência
CVE-2019-9978
CVE-2019-9978MEDIUMunder attack
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio
100RISK
open ↗
Referência
CVE-2020-0009
CVE-2020-0009—
In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This
23RISK
open ↗
Referência
CVE-2018-25342
CVE-2018-25342HIGH
Smartshop 1 SQL Injection via search.php
41RISK
open ↗
Referência
CVE-2018-25341
CVE-2018-25341HIGH
Smartshop 1 SQL Injection via product.php id Parameter
41RISK
open ↗
Referência
CVE-2021-47955
CVE-2021-47955MEDIUM
CouchCMS 2.2.1 Cross-Site Scripting via SVG File Upload
33RISK
open ↗
Referência
CVE-2021-47954
CVE-2021-47954HIGH
LayerBB 1.1.4 SQL Injection via search_query Parameter
41RISK
open ↗
Referência
CVE-2020-37228
CVE-2020-37228CRITICAL
iDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security Bypass
48RISK
open ↗
Referência
CVE-2020-37227
CVE-2020-37227HIGH
WordPress Plugin HS Brand Logo Slider 2.1 Unrestricted File Upload
41RISK
open ↗
Referência
CVE-2018-25336
CVE-2018-25336MEDIUM
jCart for OpenCart 2.3.0.2 Cross-Site Request Forgery
33RISK
open ↗
Referência
CVE-2018-25335
CVE-2018-25335CRITICAL
WordPress Plugin Peugeot Music 1.0 Arbitrary File Upload
48RISK
open ↗
Referência
CVE-2018-25333
CVE-2018-25333HIGH
Nordex N149/4.0-4.5 Wind Turbine Web Server SQL Injection
41RISK
open ↗
Referência
CVE-2018-25332
CVE-2018-25332CRITICAL
GitBucket 4.23.1 Unauthenticated Remote Code Execution
48RISK
open ↗
Referência
CVE-2018-25331
CVE-2018-25331MEDIUM
Zenar Content Management System Cross-Site Scripting via ajax.php
33RISK
open ↗
Referência
CVE-2018-25330
CVE-2018-25330HIGH
Joomla! EkRishta 2.10 Persistent XSS and SQL Injection
41RISK
open ↗
Referência
CVE-2018-25329
CVE-2018-25329HIGH
WordPress Plugin WP with Spritz 1.0 Remote File Inclusion
41RISK
open ↗
Referência
CVE-2020-10220
CVE-2020-10220—
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php
60RISK
open ↗
Referência
CVE-2020-10220
CVE-2020-10220—
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php
60RISK
open ↗
Referência
CVE-2020-10220
CVE-2020-10220—
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php
60RISK
open ↗
Referência
CVE-2026-66731
CVE-2026-66731HIGH
facil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS
41RISK
open ↗
Referência
CVE-2026-66730
CVE-2026-66730HIGH
facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser
41RISK
open ↗
Referência
CVE-2026-66729
CVE-2026-66729HIGH
facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser
41RISK
open ↗
Referência
CVE-2025-9486
CVE-2025-9486LOW
Incorrect Privilege Assignment in GitLab
28RISK
open ↗
← previouspage 500 / 745next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.