Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,432cataloged exploits
34,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,493GitHub PoC 13,618VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
4,217 exploits
Nucleimedium
PropertyHive < 2.1.1 - Cross-Site Scripting
CVE-2024-12585MEDIUM
PropertyHive < 2.1.1 - Reflected XSS
28RISK
open ↗
Nucleihigh
Bulk Me Now! Plugin <= 2.0 - Cross-Site Scripting
CVE-2024-12638HIGH
Bulk Me Now <= 2.0 - Reflected XSS
36RISK
open ↗
Nucleimedium
WP DeskLite - Reflected XSS
CVE-2024-12724MEDIUM
WP DeskLite <= 1.0.0 - Reflected XSS
28RISK
open ↗
Nucleimedium
AffiliateImporterEb <= 1.0.6 - Reflected XSS
CVE-2024-12732MEDIUM
AffiliateImporterEb <= 1.0.6 - Reflected XSS
28RISK
open ↗
Nucleimedium
Advance Post Prefix WordPress plugin - Reflected XSS
CVE-2024-12734MEDIUM
Advance Post Prefix <= 1.1.1 - Reflected XSS
28RISK
open ↗
Nucleimedium
WP BASE Booking - Reflected XSS
CVE-2024-12737MEDIUM
WP BASE Booking of Appointments, Services and Events < 5.0.0 - Reflected XSS
28RISK
open ↗
Nucleihigh
WordPress Competition Form Plugin <= 2.0 - Cross-Site Scripting
CVE-2024-12749HIGH
Competition Form <= 2.0 - Reflected XSS
36RISK
open ↗
Nucleimedium
BentoML v1.3.9 - Open Redirect
CVE-2024-12760—
15RISK
open ↗
Nucleicritical
Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change
CVE-2024-12824CRITICAL
Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change
43RISK
open ↗
Nucleihigh
Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Arbitrary File Read
CVE-2024-12849HIGH
Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read
48RISK
open ↗
Nucleimedium
Custom Field Manager WordPress - Cross-Site Scripting
CVE-2024-12873MEDIUM
Custom Field Manager <= 1.0 - Reflected XSS Vulnerability
28RISK
open ↗
Nucleimedium
Lazy Blocks <= 3.8.2 - Cross-Site Scripting
CVE-2024-12878HIGH
Custom Block Builder – Lazy Blocks < 3.8.3 - Reflected XSS
36RISK
open ↗
Nucleicritical
DrayTek Vigor - Command Injection
CVE-2024-12987MEDIUMunder attack
DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection
100RISK
open ↗
Nucleihigh
Dyn Business Panel Plugin <= 1.0.0 - Cross-Site Scripting
CVE-2024-13055HIGH
Dyn Business Panel <= 1.0.0 - Reflected XSS
36RISK
open ↗
Nucleihigh
WP Triggers Lite - Cross-Site Scripting
CVE-2024-13094HIGH
WP Triggers Lite <= 2.5.3 - Reflected XSS
36RISK
open ↗
Nucleimedium
WP Finance Plugin <= 1.3.6 - Cross-Site Scripting
CVE-2024-13097MEDIUM
WP Finance <= 1.3.6 - Reflected XSS
28RISK
open ↗
Nucleimedium
WordPress Email Newsletter - Reflected XSS
CVE-2024-13098MEDIUM
WP Email Newsletter <= 1.1 - Reflected XSS
28RISK
open ↗
Nucleimedium
Widget4Call WordPress - Cross-Site Scripting
CVE-2024-13099MEDIUM
Widget4call <= 1.0.7 - Reflected XSS
28RISK
open ↗
Nucleimedium
WP MediaTagger <= 4.1.1 - Cross-Site Scripting
CVE-2024-13112MEDIUM
WP MediaTagger <= 4.1.1 - Reflected XSS
28RISK
open ↗
Nucleimedium
WP Projects Portfolio <= 3.0 - Cross-Site Scripting
CVE-2024-13114MEDIUM
WP Projects Portfolio with Client Testimonials <= 3.0 - Reflected XSS
28RISK
open ↗
Nucleimedium
WordPress Download Manager < 3.3.07 - Unauthenticated Data Exposure
CVE-2024-13126MEDIUM
Download Manager < 3.3.07 - Unauthenticated Data Exposure
28RISK
open ↗
Nucleicritical
Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcardRecursive
CVE-2024-13159CRITICALunder attack
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Up
100RISK
open ↗
Nucleicritical
Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcard
CVE-2024-13160CRITICALunder attack
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Up
100RISK
open ↗
Nucleicritical
Ivanti EPM - Credential Coercion Vulnerability in GetHashForSingleFile
CVE-2024-13161CRITICALunder attack
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Up
100RISK
open ↗
Nucleimedium
Privacy Policy Genius - Cross-Site Scripting
CVE-2024-13219MEDIUM
Policy Genius <= 2.0.4 - Reflected XSS
28RISK
open ↗
Nucleimedium
WordPress Google Map Professional - Cross-Site Scripting
CVE-2024-13220MEDIUM
Google Map Professional <= 1.0 - Reflected XSS
28RISK
open ↗
Nucleimedium
Fantastic ElasticSearch Plugin <= 4.1.0 - Cross-Site Scripting
CVE-2024-13221MEDIUM
Fantastic Elasticsearch <= 4.1.0 - Reflected XSS
28RISK
open ↗
Nucleimedium
WordPress User Messages <= 1.2.4 - Reflected XSS
CVE-2024-13222MEDIUM
User Messages <= 1.2.4 - Reflected XSS
28RISK
open ↗
Nucleimedium
SlideDeck 1 Lite Content Slider - Cross-Site Scripting
CVE-2024-13224MEDIUM
SlideDeck 1 Lite Content Slider <= 1.4.8 - Reflected XSS
28RISK
open ↗
Nucleimedium
ECT Home Page Products - Reflected XSS
CVE-2024-13225MEDIUM
ECT Home Page Products <= 1.9 - Reflected XSS
28RISK
open ↗
← previouspage 117 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.