Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,883cataloged exploits
40,037CVEs with public exploitation
24,696lab-tested
AllReferência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
4,527 exploits
Nucleihigh
Intelbras TIP 200/200 LITE/300 - Local File Inclusion
Intelbras TIP 200 60.61.75.15, TIP 200 LITE 60.61.75.15, and TIP 300 65.61.75.22 devices allow cgi-bin/cgiServer.exx?pag
18RISK
open ↗Nucleicritical
Airflow Experimental <1.10.11 - REST API Auth Bypass
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but th
100RISK
open ↗Nucleimedium
Apache Kylin - Exposed Configuration File
Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.
40RISK
open ↗Nucleicritical
Apache Unomi <1.5.2 - Remote Code Execution
Remote Code Execution in Apache Unomi
50RISK
open ↗Nucleimedium
Apache APISIX - Insufficiently Protected Credentials
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the
40RISK
open ↗Nucleicritical
WordPress PayPal Pro <1.1.65 - SQL Injection
The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.
40RISK
open ↗Nucleihigh
Gitea 1.1.0 - 1.12.5 - Remote Code Execution
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
40RISK
open ↗Nucleimedium
Atlassian Jira Server/Data Center <8.5.8/8.6.0 - 8.11.1 - Information Disclosure
Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field
40RISK
open ↗Nucleimedium
Jira Server and Data Center - Information Disclosure
Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Infor
60RISK
open ↗Nucleimedium
Agentejo Cockpit 0.10.2 - Cross-Site Scripting
An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login rou
18RISK
open ↗Nucleimedium
NeDi 1.9C - Cross-Site Scripting
NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php. This function at
18RISK
open ↗Nucleicritical
Oracle WebLogic Server - Remote Command Execution
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
open ↗Nucleihigh
Oracle Fusion - Directory Traversal/Local File Inclusion
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ins
100RISK
open ↗Nucleicritical
Oracle Weblogic Server - Remote Command Execution
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
open ↗Nucleihigh
Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
open ↗Nucleihigh
Suprema BioStar <2.8.2 - Local File Inclusion
An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary fi
50RISK
open ↗Nucleilow
PrestaShop < 1.7.6.6 - Information Exposure via Upload Directory
Information exposure in the upload directory in PrestaShop
28RISK
open ↗Nucleicritical
Nette Framework - Remote Code Execution
Remote Code Execution vulnerability
68RISK
open ↗Nucleicritical
DrayTek Vigor - Command Injection
On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote
95RISK
open ↗Nucleimedium
TileServer GL <=3.0.0 - Cross-Site Scripting
An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected u
43RISK
open ↗Nucleicritical
MobileIron Core & Connector <= v10.6 & Sentry <= v9.8 - Remote Code Execution
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,
100RISK
open ↗Nucleicritical
TerraMaster TOS <.1.29 - Remote Code Execution
TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic cla
43RISK
open ↗Nucleimedium
RosarioSIS 6.7.2 - Cross-Site Scripting
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php sc
38RISK
open ↗Nucleihigh
Gogs 0.5.5 - 0.12.2 - Remote Code Execution
The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privile
40RISK
open ↗Nucleimedium
D-Link DIR-816L 2.x - Cross-Site Scripting
An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no outp
18RISK
open ↗Nucleicritical
Tiki Wiki CMS GroupWare - Authentication Bypass
tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.
23RISK
open ↗Nucleicritical
Mida eFramework <=2.9.0 - Remote Command Execution
There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Executi
60RISK
open ↗Nucleihigh
Cisco Unified IP Conference Station 7937G - Denial-of-Service
A denial-of-service in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers restart the de
40RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.