Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
75,432cataloged exploits
34,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,493GitHub PoC 13,618VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
4,217 exploits
Nucleicritical
phpVMS < 7.0.6 - Legacy Importer Authorization Bypass
phpvms: /importer authorization bypass causing full database wipe
43RISK
open ↗Nucleicritical
WordPress Contact Form by Supsystic - Server-Side Template Injection
Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
75RISK
open ↗Nucleicritical
Gotenberg - Command Injection
Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection
63RISK
open ↗Nucleicritical
JoomSport <= 5.7.7 - SQL Injection
WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability
63RISK
open ↗Nucleicritical
Arelle < 2.39.10 - Remote Code Execution
Arelle < 2.39.10 Unauthenticated RCE via /rest/configure
43RISK
open ↗Nucleicritical
Scramble Laravel - Remote Code Execution
Scramble: Remote code execution via evaluation of user-controlled input in validation rules
63RISK
open ↗Nucleicritical
Open WebUI 'LDAP Empty Password' - Authentication Bypass
Open WebUI: LDAP Empty Password Authentication Bypass
43RISK
open ↗Nucleihigh
Dozzle - Server Side Request Forgery
Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)
36RISK
open ↗Nucleimedium
Open WebUI < 0.9.5 - Information Disclosure
Open WebUI: Unauthenticated RAG Configuration Disclosure
28RISK
open ↗Nucleicritical
Cockpit Web Console < 360 - Remote Code Execution
Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection
68RISK
open ↗Nucleicritical
9Router <= 0.4.36 - Unauthenticated RCE
9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
43RISK
open ↗Nucleicritical
phpMyFAQ <= 4.1.1 - SQL Injection
phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha
43RISK
open ↗Nucleihigh
SillyTavern - Server-Side Request Forgery
SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl
36RISK
open ↗Nucleicritical
Flowise < 3.1.2 - node-custom-function Unauthorized RCE
Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape
63RISK
open ↗Nucleicritical
TYPO3 ceselector Extension - Insecure Deserialization
Remote Code Execution in extension "Content Element Selector" (ceselector)
43RISK
open ↗Nucleicritical
DbGate - Remote Code Execution via Anonymous JWT
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
63RISK
open ↗Nucleicritical
DbGate - Remote Code Execution via Dynamic Import Bypass
DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection
63RISK
open ↗Nucleicritical
Google ADK-Python - Unauthenticated Builder Endpoint
Remote Code Execution in Google Agent Development Kit (ADK)
43RISK
open ↗Nucleicritical
Adobe ColdFusion - RDS Arbitrary File Write
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
85RISK
open ↗Nucleihigh
ColdFusion - Path Traversal
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
43RISK
open ↗Nucleicritical
phpBB < 3.3.17 - Authentication Bypass
Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or
63RISK
open ↗Nucleicritical
Starlette - Improper Validation of Unsafe Equivalence in Input
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
48RISK
open ↗Nucleicritical
Joomla! JCE extension < 2.9.99.5 unauthenticated RCE
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISK
open ↗Nucleicritical
WordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCE
WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability
63RISK
open ↗Nucleimedium
Apache Tomcat - Cross-Site Scripting
Apache Tomcat: XSS in number guess example
48RISK
open ↗Nucleimedium
Lyrion Music Server <= 9.2.0 - Cross-Site Scripting
Lyrion Music Server 9.2.0 Reflected XSS via server.log
28RISK
open ↗Nucleihigh
Langflow <= 1.8.4 - Path Traversal to RCE via File Upload
Langflow - Path Traversal Arbitrary File Write via upload_user_file
68RISK
open ↗Nucleicritical
WordPress ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection
ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection via 'order' Parameter
36RISK
open ↗Nucleicritical
Check Point IKEv1 Remote-Access VPN - Certificate Authentication Bypass
User Authentication Bypass in VPN Remote Access and Mobile Access
100RISK
open ↗Nucleilow
Gogs < 0.14.3 - Unauthenticated Organization Teams Disclosure
Gogs: Unauthenticated Organization Teams Information Disclosure via API
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.