Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,682cataloged exploits
39,953CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
4,513 exploits
Nucleicritical
InstaWP Connect <= 0.1.0.22 - Unauthenticated Arbitrary File Upload
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload
63RISK
open ↗Nucleihigh
SOPlanning - Remote Code Execution
Remote Code Execution through File Upload in SOPlanning before 1.52.02
43RISK
open ↗Nucleicritical
TeamCity < 2023.11.4 - Authentication Bypass
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
100RISK
open ↗Nucleihigh
TeamCity < 2023.11.4 - Authentication Bypass
In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
100RISK
open ↗Nucleihigh
Docassemble - Local File Inclusion
Docassemble unauthorized access through URL manipulation
68RISK
open ↗Nucleicritical
WP-Recall <= 16.26.5 - SQL Injection
WordPress WP-Recall plugin <= 16.26.5 - SQL Injection vulnerability
43RISK
open ↗Nucleicritical
D-Link Network Attached Storage - Backdoor Account
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials
100RISK
open ↗Nucleicritical
D-Link Network Attached Storage - Command Injection and Backdoor Account
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection
100RISK
open ↗Nucleicritical
CyberPower - Missing Authentication
CyberPower PowerPanel Enterprise Missing Authentication
43RISK
open ↗Nucleihigh
CyberPower < v2.8.3 - SQL Injection
CyberPower PowerPanel Enterprise SQL Injection
36RISK
open ↗Nucleihigh
CyberPower < v2.8.3 - SQL Injection
CyberPower PowerPanel Enterprise SQL Injection
36RISK
open ↗Nucleimedium
D-LINK DNS-320L,DNS-320LW and DNS-327L - Information Disclosure
D-Link DNS-320L/DNS-320LW/DNS-327L HTTP GET Request info.cgi information disclosure
40RISK
open ↗Nucleimedium
Simply Static - Information Disclosure
WordPress Simply Static plugin <= 3.1.3 - Sensitive Data Exposure via Log File vulnerability
36RISK
open ↗Nucleimedium
iTop Hub Connector - Information Disclosure
iTop hub connector Information disclosure
28RISK
open ↗Nucleicritical
Lobe Chat <= v0.150.5 - Server-Side Request Forgery
lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability
55RISK
open ↗Nucleicritical
Delmia Apriso - Pre-Authentication Unsafe .NET Object Deserialization
Pre-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024
43RISK
open ↗Nucleimedium
D-LINK DIR-845L bsc_sms_inbox.php file - Information Disclosure
D-LINK DIR-845L <=v1.01KRb03 is vulnerable to Information disclosurey via bsc_sms_inbox.php.
28RISK
open ↗Nucleihigh
Prison Management System - SQL Injection Authentication Bypass
Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the
56RISK
open ↗Nucleimedium
LumisXP - Cross-site Scripting
A cross-site scripting (XSS) vulnerability in the component XsltResultControllerHtml.jsp of Lumisxp v15.0.x to v16.1.x a
28RISK
open ↗Nucleimedium
User Meta WP Plugin < 3.1 - Sensitive Information Exposure
WordPress User Meta plugin <= 3.0 - Sensitive Data Exposure vulnerability
28RISK
open ↗Nucleihigh
Sharp Multifunction Printers - Directory Listing
Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability. As for th
36RISK
open ↗Nucleimedium
Sharp Multifunction Printers - Cookie Exposure
"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides log
55RISK
open ↗Nucleimedium
SOPlanning 1.52.00 Cross Site Scripting
SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.
48RISK
open ↗Nucleimedium
iboss Secure Web Gateway - Stored Cross-Site Scripting
iboss Secure Web Gateway Login Portal login cross site scripting
33RISK
open ↗Nucleimedium
OneNav v0.9.35-20240318 - Server-Side Request Forgery (SSRF)
OneNav v0.9.35-20240318 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /index.php?c=ap
28RISK
open ↗Nucleimedium
Masteriyo LMS <= 1.7.3 - Insecure Direct Object Reference
WordPress LMS by Masteriyo plugin <= 1.7.3 - Broken Authentication vulnerability
28RISK
open ↗Nucleicritical
GlobalProtect - OS Command Injection
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
100RISK
open ↗Nucleimedium
Changedetection.io <=v0.45.21 - Cross-Site Scripting
Reflected cross site scripting in changedetection.io
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.