Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,620cataloged exploits
35,647CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,429GitHub PoC 14,270VulnCheck XDB 8,693Nuclei 4,299Metasploit 3,474✓ verified onlyrecentpopularrisk
22,429 exploits
Referência
CVE-2026-11504
CVE-2026-11504HIGH
Tenda CX12L Wi-Fi Schedule Configuration Endpoint openSchedWifi setSchedWifi stack-based overflow
41RISK
open ↗
Referência
CVE-2019-12372
CVE-2019-12372—
Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form.
23RISK
open ↗
Referência
CVE-2019-13272
CVE-2019-13272HIGHunder attack
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proce
98RISK
open ↗
Referência
CVE-2019-13272
CVE-2019-13272HIGHunder attack
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proce
98RISK
open ↗
Referência
CVE-2019-13272
CVE-2019-13272HIGHunder attack
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proce
98RISK
open ↗
Referência
CVE-2019-13272
CVE-2019-13272HIGHunder attack
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proce
98RISK
open ↗
Referência
CVE-2026-14549
CVE-2026-14549MEDIUM
Ray Enterprise Translation <= 1.7.3 - Subscriber+ Language Addition and Deletion
33RISK
open ↗
Referência
CVE-2026-14548
CVE-2026-14548MEDIUM
Ray Enterprise Translation <= 1.7.3 - Subscriber+ Arbitrary API Token Update
33RISK
open ↗
Referência
CVE-2026-73030
CVE-2026-73030HIGH
unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape
41RISK
open ↗
Referência
CVE-2026-72743
CVE-2026-72743MEDIUM
SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html
33RISK
open ↗
Referência
CVE-2026-69118
CVE-2026-69118HIGH
Cachet 2.4.1 Authenticated Server-Side Template Injection RCE
41RISK
open ↗
Referência
CVE-2026-9632
CVE-2026-9632HIGH
UTT HiPER 1250GW Web Management formGroupConfig strcpy stack-based overflow
41RISK
open ↗
Referência
CVE-2026-15238
CVE-2026-15238MEDIUM
Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR
33RISK
open ↗
Referência
CVE-2026-15237
CVE-2026-15237MEDIUM
Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint
33RISK
open ↗
Referência
CVE-2026-9478
CVE-2026-9478CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection
48RISK
open ↗
Referência
CVE-2026-19376
CVE-2026-19376MEDIUM
Uasoft Badaso File API api.php class permission
33RISK
open ↗
Referência
CVE-2026-19375
CVE-2026-19375MEDIUM
dmitriiweb article-scraper-mcp server.py fetch_article server-side request forgery
33RISK
open ↗
Referência
WebERP 4.15 - SQL injection
CVE-2019-13292—webappsphp
A SQL Injection issue was discovered in webERP 4.15. Payments.php accepts payment data in base64 format. After this is d
23RISK
open ↗
Referência
CVE-2026-19353
CVE-2026-19353LOW
DedeCMS Installation Wizard index.php _4_Setup file inclusion
28RISK
open ↗
Referência
CVE-2019-1346
CVE-2019-1346—
A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Servi
28RISK
open ↗
Referência
CVE-2019-13494
CVE-2019-13494—
nodeimp.exe in Castle Rock SNMPc before 9.0.12.1 and 10.x before 10.0.9 has a stack-based buffer overflow via a long var
23RISK
open ↗
Referência
CVE-2019-13529
CVE-2019-13529HIGH
An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform action
41RISK
open ↗
Referência
CVE-2019-13529
CVE-2019-13529HIGH
An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform action
41RISK
open ↗
Referência
CentOS Control Web Panel 0.9.8.836 - Authentication Bypass
CVE-2019-13605—webappslinux
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in
28RISK
open ↗
Referência
CVE-2026-9428
CVE-2026-9428HIGH
Tenda F1202 PPTPUserSetting fromPPTPUserSetting stack-based overflow
41RISK
open ↗
Referência
CVE-2018-25350
CVE-2018-25350CRITICAL
userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php
48RISK
open ↗
Referência
CVE-2018-25340
CVE-2018-25340HIGH
Smartshop 1 SQL Injection via category.php
41RISK
open ↗
Referência
CVE-2026-9306
CVE-2026-9306MEDIUM
QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization
33RISK
open ↗
Referência
CVE-2026-9305
CVE-2026-9305MEDIUM
QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection
33RISK
open ↗
Referência
CVE-2026-9304
CVE-2026-9304LOW
calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery
28RISK
open ↗
← previouspage 557 / 748next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.