Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,682cataloged exploits
39,953CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
4,513 exploits
Nucleihigh
OpenEMR <5.0.2 - Local File Inclusion
An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can
50RISK
open ↗Nucleimedium
Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting
Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter.
43RISK
open ↗Nucleimedium
osTicket < 1.12.1 - Cross-Site Scripting
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It w
43RISK
open ↗Nucleimedium
Custom 404 Pro < 3.2.8 - Cross-Site Scripting
The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.
18RISK
open ↗Nucleihigh
Meta Box <= 4.16.2 - Arbitrary File Deletion
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=r
18RISK
open ↗Nucleimedium
WP Live Chat Support <= 8.0.27 — Stored Cross-Site Scripting
The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.
18RISK
open ↗Nucleimedium
SugarCRM Enterprise 9.0.0 - Cross-Site Scripting
SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.
43RISK
open ↗Nucleihigh
Grafana - Improper Access Control
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run
30RISK
open ↗Nucleicritical
Webmin <= 1.920 - Unauthenticated Remote Command Execution
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RISK
open ↗Nucleimedium
L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting
Reflected cross site scripting (XSS) in L-Soft LISTSERV before 16.5-2018a exists via the /scripts/wa.exe OK parameter.
38RISK
open ↗Nucleihigh
Webmin < 1.920 - Authenticated Remote Code Execution
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise
50RISK
open ↗Nucleimedium
WordPress My Calendar <= 3.1.9 - Cross-Site Scripting
The my-calendar plugin before 3.1.10 for WordPress has XSS.
18RISK
open ↗Nucleimedium
ND Booking < 2.5 - Unauthenticated Options Change
The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting
18RISK
open ↗Nucleimedium
DomainMOD <=4.13.0 - Cross-Site Scripting
In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.
38RISK
open ↗Nucleihigh
WPS Hide Login <= 1.5.2.2 - Login Page Bypass
The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.
18RISK
open ↗Nucleimedium
Gallery Photoblocks < 1.1.43 - Cross-Site Scripting
The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.
18RISK
open ↗Nucleihigh
WordPress Woody Ad Snippets <2.2.5 - Cross-Site Scripting/Remote Code Execution
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthentica
23RISK
open ↗Nucleicritical
Socomec DIRIS A-40 Devices Password Disclosure
Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get f
30RISK
open ↗Nucleimedium
WordPress Download Manager <2.9.94 - Cross-Site Scripting
The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by t
53RISK
open ↗Nucleicritical
D-Link DNS-320 - Remote Code Execution
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
95RISK
open ↗Nucleicritical
Enigma NMS < 65.0.0 - Authenticated OS Command Injection
An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows
43RISK
open ↗Nucleimedium
Harbor <=1.82.0 - Privilege Escalation
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users A
23RISK
open ↗Nucleihigh
PilusCart <=1.4.1 - Local File Inclusion
In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File D
23RISK
open ↗Nucleimedium
LabKey Server Community Edition <18.3.0 - Open Redirect
An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL param
18RISK
open ↗Nucleicritical
Barco/AWIND OEM Presentation Platform - Remote Command Injection
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Ba
100RISK
open ↗Nucleimedium
IBM BigFix Platform - Information Disclosure
IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the upd
33RISK
open ↗Nucleicritical
IBM Planning Analytics - Authentication Bypass & Remote Code Execution Version Detection
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated use
100RISK
open ↗Nucleicritical
YouPHPTube Encoder 2.3 - Remote Command Injection
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the
55RISK
open ↗Nucleicritical
YouPHPTube Encoder - Arbitrary File Write
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the
55RISK
open ↗Nucleicritical
YouPHPTube Encoder 2.3 - Command Injection
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the
55RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.