Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,432cataloged exploits
34,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,493GitHub PoC 13,618VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
4,217 exploits
Nucleimedium
OpenCATS 0.9.6 - Cross-Site Scripting
CVE-2022-43014MEDIUM
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parame
28RISK
open ↗
Nucleimedium
OpenCATS 0.9.6 - Cross-Site Scripting
CVE-2022-43015MEDIUM
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage pa
28RISK
open ↗
Nucleimedium
OpenCATS 0.9.6 - Cross-Site Scripting
CVE-2022-43016MEDIUM
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback componen
28RISK
open ↗
Nucleimedium
OpenCATS 0.9.6 - Cross-Site Scripting
CVE-2022-43017MEDIUM
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile compone
28RISK
open ↗
Nucleimedium
OpenCATS 0.9.6 - Cross-Site Scripting
CVE-2022-43018MEDIUM
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter i
28RISK
open ↗
Nucleicritical
Login as User or Customer < 3.3 - Privilege Escalation
CVE-2022-4305CRITICAL
Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to Admin
75RISK
open ↗
Nucleimedium
WordPress Panda Pods Repeater Field <1.5.4 - Cross-Site Scripting
CVE-2022-4306MEDIUM
Panda Pods Repeater Field < 1.5.4 - Reflected XSS
28RISK
open ↗
Nucleihigh
kkFileView 4.1.0 - Server-Side Request Forgery
CVE-2022-43140HIGH
kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.control
36RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross Site Scripting
CVE-2022-43164MEDIUM
A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of
28RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross Site Scripting
CVE-2022-43165MEDIUM
A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) o
28RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross Site Scripting
CVE-2022-43166MEDIUM
A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) o
28RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross Site Scripting
CVE-2022-43167MEDIUM
A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_aler
28RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross-Site Scripting
CVE-2022-43169MEDIUM
A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/use
28RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross Site Scripting
CVE-2022-43170MEDIUM
A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_con
28RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross-Site Scripting
CVE-2022-43185MEDIUM
A stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows atta
28RISK
open ↗
Nucleimedium
WordPress Events Calendar <1.4.5 - Cross-Site Scripting
CVE-2022-4320MEDIUM
WordPress Events Calendar Plugin < 1.4.5 - Multiple Reflected XSS
28RISK
open ↗
Nucleimedium
PDF Generator for WordPress < 1.1.2 - Cross Site Scripting
CVE-2022-4321MEDIUM
PDF Generator for WordPress < 1.1.2 - Reflected XSS
28RISK
open ↗
Nucleimedium
WordPress Post Status Notifier Lite <1.10.1 - Cross-Site Scripting
CVE-2022-4325MEDIUM
Post Status Notifier Lite < 1.10.1 - Reflected XSS
28RISK
open ↗
Nucleicritical
WooCommerce Checkout Field Manager < 18.0 - Arbitrary File Upload
CVE-2022-4328CRITICAL
WooCommerce Checkout Field Manager < 18.0 - Unauthenticated Arbitrary File Upload
63RISK
open ↗
Nucleicritical
Mingsoft MCMS - SQL Injection
CVE-2022-4375MEDIUM
Mingsoft MCMS list sql injection
28RISK
open ↗
Nucleihigh
Hitachi Pentaho Business Analytics Server - Remote Code Execution
CVE-2022-43769HIGHunder attack
Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
100RISK
open ↗
Nucleihigh
Hitachi Pentaho Business Analytics Server - Bypass Authorization
CVE-2022-43939HIGHunder attack
Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions
100RISK
open ↗
Nucleicritical
Yii2 PHP Framework < 2.0.52 - Remote Code Execution
CVE-2024-58136CRITICALunder attack
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regres
95RISK
open ↗
Nucleicritical
Vanna - SQL injection
CVE-2024-5827CRITICAL
Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna
43RISK
open ↗
Nucleicritical
Palo Alto Expedition - Admin Account Takeover
CVE-2024-5910CRITICALunder attack
Expedition: Missing Authentication Leads to Admin Account Takeover
100RISK
open ↗
Nucleicritical
GiveWP - PHP Object Injection
CVE-2024-5932CRITICAL
GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution
85RISK
open ↗
Nucleimedium
PrivateGPT < 0.5.0 - Open Redirect
CVE-2024-5936MEDIUM
Open Redirect in imartinez/privategpt
33RISK
open ↗
Nucleimedium
Deep Sea Electronics DSE855 - Authentication Bypass
CVE-2024-5947MEDIUM
Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability
28RISK
open ↗
Nucleicritical
CZ Loan Management <= 1.1 - SQL Injection
CVE-2024-5975CRITICAL
CZ Loan Management <= 1.1 - Unauthenticated SQLi
43RISK
open ↗
Nucleicritical
Quiz Maker <= 6.5.8.3 - SQL Injection
CVE-2024-6028CRITICAL
Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter
68RISK
open ↗
← previouspage 106 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.