Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,620cataloged exploits
35,647CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,429GitHub PoC 14,270VulnCheck XDB 8,693Nuclei 4,299Metasploit 3,474✓ verified onlyrecentpopularrisk
22,429 exploits
Referência
CVE-2026-58166
CVE-2026-58166HIGH
OpenBMB ChatDev - Unauthenticated Path Traversal in Upload Handler Allows Arbitrary File Write and Delete
41RISK
open ↗
Referência
CVE-2026-58116
CVE-2026-58116CRITICAL
LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path
48RISK
open ↗
Referência
CVE-2026-13580
CVE-2026-13580HIGH
Edimax EW-7478APC POST Request formQoS buffer overflow
41RISK
open ↗
Referência
CVE-2026-13545
CVE-2026-13545HIGH
D-Link DCS-935L POST Parameter setconf.cgi sub_400E40 os command injection
41RISK
open ↗
Referência
CVE-2026-13544
CVE-2026-13544MEDIUM
Feehi CMS API users access control
33RISK
open ↗
Referência
CVE-2026-13541
CVE-2026-13541MEDIUM
itsourcecode Hospital Management System doctorchangepassword.php sql injection
33RISK
open ↗
Referência
CVE-2026-13515
CVE-2026-13515HIGH
Tenda JD12L SetPptpServerCfg formSetPPTPServer stack-based overflow
41RISK
open ↗
Referência
CVE-2025-12669
CVE-2025-12669MEDIUM
Improper Control of Generation of Code ('Code Injection') in GitLab
33RISK
open ↗
Referência
CVE-2020-37236
CVE-2020-37236MEDIUM
NewsLister Authenticated Persistent Cross-Site Scripting via Admin Panel
33RISK
open ↗
Referência
CVE-2020-37235
CVE-2020-37235MEDIUM
WordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Component
33RISK
open ↗
Referência
CVE-2020-37234
CVE-2020-37234MEDIUM
Internet Download Manager 6.38.12 Scheduler Buffer Overflow
33RISK
open ↗
Referência
CVE-2020-37233
CVE-2020-37233MEDIUM
WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting
33RISK
open ↗
Referência
CVE-2020-37230
CVE-2020-37230HIGH
Syncplify.me Server! 5.0.37 Unquoted Service Path Privilege Escalation
41RISK
open ↗
Referência
CVE-2020-37229
CVE-2020-37229HIGH
OKI sPSV Port Manager 1.0.41 Unquoted Service Path Privilege Escalation
41RISK
open ↗
Referência
CVE-2021-47965
CVE-2021-47965CRITICAL
WordPress Plugin WP Super Edit 2.5.4 Unrestricted File Upload
48RISK
open ↗
Referência
CVE-2025-13874
CVE-2025-13874MEDIUM
Authorization Bypass Through User-Controlled Key in GitLab
33RISK
open ↗
Referência
CVE-2025-14869
CVE-2025-14869HIGH
Improper Validation of Specified Quantity in Input in GitLab
41RISK
open ↗
Referência
CVE-2025-14870
CVE-2025-14870HIGH
Allocation of Resources Without Limits or Throttling in GitLab
41RISK
open ↗
Referência
CVE-2026-3607
CVE-2026-3607MEDIUM
Access Control Check Implemented After Asset is Accessed in GitLab
33RISK
open ↗
Referência
CVE-2019-25744
CVE-2019-25744MEDIUM
WordPress Popup Builder 3.49 Persistent Cross-Site Scripting
33RISK
open ↗
Referência
CVE-2019-25743
CVE-2019-25743MEDIUM
WordPress Soliloquy Lite 2.5.6 Persistent Cross-Site Scripting
33RISK
open ↗
Referência
CVE-2019-25742
CVE-2019-25742MEDIUM
WordPress Theme Zoner Real Estate 4.1.1 Persistent XSS
33RISK
open ↗
Referência
CVE-2019-25741
CVE-2019-25741CRITICAL
Mobatek MobaXterm 12.1 Buffer Overflow via Sessions File
48RISK
open ↗
Referência
CVE-2019-25740
CVE-2019-25740HIGH
Joomla com_jsjobs 1.2.6 Arbitrary File Deletion
41RISK
open ↗
Referência
CVE-2019-25739
CVE-2019-25739MEDIUM
GigToDo Freelance Marketplace Script 1.3 Persistent XSS
33RISK
open ↗
Referência
CVE-2019-25738
CVE-2019-25738CRITICAL
WordPress Hybrid Composer 1.4.6 Unauthenticated Settings Change
48RISK
open ↗
Referência
CVE-2019-25737
CVE-2019-25737MEDIUM
Live Chat Unlimited 2.8.3 Stored Cross-Site Scripting
33RISK
open ↗
Referência
CVE-2019-25736
CVE-2019-25736HIGH
LabF nfsAxe 3.7 Ping Client Buffer Overflow
41RISK
open ↗
Referência
CVE-2026-10529
CVE-2026-10529MEDIUM
westboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting
33RISK
open ↗
Referência
CVE-2026-10276
CVE-2026-10276MEDIUM
hekmon8 Jenkins-server-mcp get_build_status/get_build_log/trigger_build index.ts jobPath server-side request forgery
33RISK
open ↗
← previouspage 560 / 748next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.