Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

74,469cataloged exploits
34,020CVEs with public exploitation
19,614lab-tested
AllExploit-DB 23,949Referência 21,283GitHub PoC 13,359VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
4,217 exploits
Nucleihigh
Terraboard <2.2.0 - SQL Injection
CVE-2022-1883CRITICAL
SQL Injection in camptocamp/terraboard
43RISK
open ↗
Nucleihigh
ARMember < 3.4.8 - Unauthenticated Admin Account Takeover
CVE-2022-1903—
ARMember < 3.4.8 - Unauthenticated Admin Account Takeover
18RISK
open ↗
Nucleimedium
WordPress Easy Pricing Tables <3.2.1 - Cross-Site Scripting
CVE-2022-1904—
Easy Pricing Tables < 3.2.1 - Reflected Cross-Site-Scripting
18RISK
open ↗
Nucleimedium
WordPress Copyright Proof <=4.16 - Cross-Site-Scripting
CVE-2022-1906—
Copyright Proof <= 4.16 - Reflected Cross-Site-Scripting
18RISK
open ↗
Nucleimedium
WordPress Shortcodes and Extra Features for Phlox <2.9.8 - Cross-Site Scripting
CVE-2022-1910—
Shortcodes and extra features for Phlox theme < 2.9.8 - Reflected Cross-Site-Scripting
18RISK
open ↗
Nucleimedium
WordPress Active Products Tables for WooCommerce <1.0.5 - Cross-Site Scripting
CVE-2022-1916—
Active Products Tables for WooCommerce < 1.0.5 - Reflected Cross-Site-Scripting
18RISK
open ↗
Nucleimedium
WordPress CDI <5.1.9 - Cross Site Scripting
CVE-2022-1933—
CDI < 5.1.9 - Reflected Cross-Site-Scripting
18RISK
open ↗
Nucleimedium
WordPress Awin Data Feed <=1.6 - Cross-Site Scripting
CVE-2022-1937—
Awin Data Feed < 1.8 - Reflected Cross-Site Scripting
18RISK
open ↗
Nucleimedium
WordPress Gallery <2.0.0 - Cross-Site Scripting
CVE-2022-1946—
Gallery < 2.0.0 - Reflected Cross-Site Scripting
18RISK
open ↗
Nucleicritical
Youzify < 1.2.0 - Unauthenticated SQLi
CVE-2022-1950—
Youzify < 1.2.0 - Unauthenticated SQLi
18RISK
open ↗
Nucleicritical
WordPress eaSYNC Booking <1.1.16 - Arbitrary File Upload
CVE-2022-1952—
eaSYNC < 1.1.16 - Unauthenticated Arbitrary File Upload
23RISK
open ↗
Nucleimedium
WordPress Sensei LMS <4.5.0 - Information Disclosure
CVE-2022-2034—
Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API
18RISK
open ↗
Nucleimedium
Microweber < 1.2.17 - Cross-Site Scripting
CVE-2022-2130MEDIUM
Cross-site Scripting (XSS) - Reflected in microweber/microweber
28RISK
open ↗
Nucleihigh
Oracle WebLogic Server Local File Inclusion
CVE-2022-21371HIGH
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported ve
78RISK
open ↗
Nucleihigh
Oracle E-Business Suite <=12.2 - Authentication Bypass
CVE-2022-21500HIGH
Vulnerability in Oracle E-Business Suite (component: Manage Proxies). The supported version that is affected is 12.2. Ea
58RISK
open ↗
Nucleicritical
Oracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution
CVE-2022-21587CRITICALunder attackransomware
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).
100RISK
open ↗
Nucleihigh
WordPress <5.8.3 - SQL Injection
CVE-2022-21661HIGH
SQL injection in WordPress
78RISK
open ↗
Nucleimedium
WordPress Download Manager < 3.2.44 - Authenticated Cross-Site Scripting
CVE-2022-2168—
Download Manager < 3.2.44 - Reflected Cross-Site Scripting
18RISK
open ↗
Nucleihigh
October CMS - Remote Code Execution
CVE-2022-21705HIGH
Authenticated remote code execution in octobercms
36RISK
open ↗
Nucleimedium
microweber 1.2.18 - Cross-site Scripting
CVE-2022-2174MEDIUM
Cross-site Scripting (XSS) - Reflected in microweber/microweber
28RISK
open ↗
Nucleihigh
GitLab CE/EE - Remote Code Execution
CVE-2022-2185CRITICAL
A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to
85RISK
open ↗
Nucleimedium
WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting
CVE-2022-2187—
Contact Form 7 Captcha < 0.1.2 - Reflected Cross-Site Scripting
18RISK
open ↗
Nucleihigh
Unyson < 2.7.27 - Cross Site Scripting
CVE-2022-2219—
Unyson < 2.7.27 - Reflected Cross-Site Scripting
18RISK
open ↗
Nucleimedium
Juniper Web Device Manager - Cross-Site Scripting
CVE-2022-22242MEDIUM
Junos OS: Cross-site Scripting (XSS) vulnerability in J-Web
48RISK
open ↗
Nucleicritical
SAP Memory Pipes (MPI) Desynchronization
CVE-2022-22536CRITICALunder attack
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and
100RISK
open ↗
Nucleimedium
Apache ShardingSphere ElasticJob-UI privilege escalation
CVE-2022-22733—
Access-Token in ElasticJob UI causes password disclosure
30RISK
open ↗
Nucleicritical
PrestaShop AP Pagebuilder <= 2.4.4 - SQL Injection
CVE-2022-22897—
A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder
23RISK
open ↗
Nucleimedium
Trilium <0.52.4 - Cross-Site Scripting
CVE-2022-2290MEDIUM
Cross-site Scripting (XSS) - Reflected in zadam/trilium
28RISK
open ↗
Nucleicritical
Spring Cloud Gateway Code Injection
CVE-2022-22947CRITICALunder attack
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISK
open ↗
Nucleicritical
VMware Workspace ONE Access - Server-Side Template Injection
CVE-2022-22954CRITICALunder attackransomware
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa
100RISK
open ↗
← previouspage 104 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.