Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,682cataloged exploits
39,953CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
4,513 exploits
Nucleimedium
Pagination by BestWebSoft < 1.0.7 - Cross-Site Scripting
The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
PDF & Print by BestWebSoft < 1.9.4 - Cross-Site Scripting
The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
PromoBar by BestWebSoft < 1.1.1 - Cross-Site Scripting
The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Rating by BestWebSoft < 0.2 - Cross-Site Scripting
The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Realty by BestWebSoft < 1.1.0 - Cross-Site Scripting
The realty plugin before 1.1.0 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting
The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.
18RISK
open ↗Nucleimedium
Visitors Online by BestWebSoft < 1.0.0 - Cross-Site Scripting
The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Zendesk Help Center by BestWebSoft < 1.0.5 - Cross-Site Scripting
The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Google Analytics by BestWebSoft < 1.7.1 - Cross-Site Scripting
The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Google Maps by BestWebSoft < 1.3.6 - Cross-Site Scripting
The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Testimonials by BestWebSoft < 0.1.9 - Cross-Site Scripting
The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Error Log Viewer by BestWebSoft < 1.0.6 - Cross-Site Scripting
The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Sender by BestWebSoft < 1.2.1 - Cross-Site Scripting
The sender plugin before 1.2.1 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Updater by BestWebSoft < 1.35 - Cross-Site Scripting
The updater plugin before 1.35 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
User Role by BestWebSoft < 1.5.6 - Cross-Site Scripting
The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleicritical
WordPress Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution
The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or use
23RISK
open ↗Nucleimedium
Timesheet Plugin < 0.1.5 - Cross-Site Scripting
The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
WordPress Qards - Cross-Site Scripting
The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2c
18RISK
open ↗Nucleihigh
Graphite <=1.1.5 - Server-Side Request Forgery
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulner
23RISK
open ↗Nucleimedium
Formidable Forms < 2.05.02 - Cross-Site Scripting
Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting
56RISK
open ↗Nucleimedium
Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure
Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure
28RISK
open ↗Nucleimedium
FortiOS 5.4.0 to 5.6.0 - Cross-Site Scripting
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to exec
38RISK
open ↗Nucleimedium
Fortinet FortiOS < 5.6.0 - Cross-Site Scripting
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthor
38RISK
open ↗Nucleimedium
Fortinet FortiOS < 5.6.0 - Cross-Site Scripting
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthor
43RISK
open ↗Nucleimedium
OEcms 3.1 - Cross-Site Scripting
A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application. The vulnerabil
38RISK
open ↗Nucleicritical
Dell EMC Avamar and Integrated Data Protection Appliance Installation Manager - Invalid Access Control
Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection A
50RISK
open ↗Nucleihigh
Seagate NAS OS 4.3.15.1 - Server Information Disclosure
Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attac
23RISK
open ↗Nucleimedium
Seagate NAS OS 4.3.15.1 - Open Redirect
Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in th
18RISK
open ↗Nucleicritical
Intelbras NPLUG 1.0.0.14 - Authentication Bypass
Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate
18RISK
open ↗Nucleihigh
PhpMyAdmin <4.8.2 - Local File Inclusion
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute
60RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.