Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,883cataloged exploits
40,037CVEs with public exploitation
24,696lab-tested
AllReferência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
4,527 exploits
Nucleicritical
Atlassian Jira Seraph - Authentication Bypass
CVE-2022-0540CRITICAL
A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially
85RISK
open ↗
Nucleicritical
Formcraft3 <3.8.28 - Server-Side Request Forgery
CVE-2022-0591—
Formcraft3 < 3.8.28 - Unauthenticated SSRF
43RISK
open ↗
Nucleicritical
MapSVG < 6.2.20 - Unauthenticated SQLi
CVE-2022-0592—
MapSVG < 6.2.20 - Unauthenticated SQLi
23RISK
open ↗
Nucleimedium
WordPress Shareaholic <9.7.6 - Information Disclosure
CVE-2022-0594—
Shareaholic < 9.7.6 - Information Disclosure
18RISK
open ↗
Nucleimedium
WordPress Contact Form 7 <1.3.6.3 - Stored Cross-Site Scripting
CVE-2022-0595—
Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS
23RISK
open ↗
Nucleimedium
Microweber < 1.2.11 - Open Redirection
CVE-2022-0597MEDIUM
Open Redirect in microweber/microweber
28RISK
open ↗
Nucleimedium
WordPress Mapping Multiple URLs Redirect Same Page <=5.8 - Cross-Site Scripting
CVE-2022-0599—
Mapping Multiple URLs Redirect Same Page <= 5.8 - Reflected Cross-Site Scripting
18RISK
open ↗
Nucleihigh
WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection
CVE-2022-0651CRITICAL
WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type
55RISK
open ↗
Nucleimedium
Wordpress Profile Builder Plugin Cross-Site Scripting
CVE-2022-0653MEDIUM
Profile Builder – User Profile & User Registration Forms <= 3.6.1 Reflected Cross-Site Scripting
28RISK
open ↗
Nucleihigh
uDraw <3.3.3 - Local File Inclusion
CVE-2022-0656—
uDraw < 3.3.3 - Unauthenticated Arbitrary File Access
18RISK
open ↗
Nucleicritical
CommonsBooking < 2.6.8 - SQL Injection
CVE-2022-0658—
CommonsBooking < 2.6.8 - Unauthenticated SQL Injection
18RISK
open ↗
Nucleihigh
Microweber <1.2.11 - Information Disclosure
CVE-2022-0660CRITICAL
Generation of Error Message Containing Sensitive Information in microweber/microweber
43RISK
open ↗
Nucleihigh
Microweber < 1.2.11 - CRLF Injection
CVE-2022-0666HIGH
CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in microweber/microweber
48RISK
open ↗
Nucleimedium
Microweber <1.2.11 - Cross-Site Scripting
CVE-2022-0678MEDIUM
Cross-site Scripting (XSS) - Reflected in microweber/microweber
28RISK
open ↗
Nucleicritical
WordPress Narnoo Distributor <=2.5.1 - Local File Inclusion
CVE-2022-0679—
Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCE
30RISK
open ↗
Nucleimedium
Rudloff alltube prior to 3.0.1 - Open Redirect
CVE-2022-0692MEDIUM
Open Redirect on Rudloff/alltube in rudloff/alltube
28RISK
open ↗
Nucleicritical
WordPress Master Elements <=8.0 - SQL Injection
CVE-2022-0693—
Master Elements <= 8.0 - Unauthenticated SQLi
18RISK
open ↗
Nucleicritical
GitLab CE/EE - Information Disclosure
CVE-2022-0735CRITICAL
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
48RISK
open ↗
Nucleicritical
Infographic Maker iList < 4.3.8 - SQL Injection
CVE-2022-0747—
Infographic Maker - iList < 4.3.8 - Unauthenticated SQL Injection
23RISK
open ↗
Nucleicritical
WordPress Simple Link Directory <7.7.2 - SQL injection
CVE-2022-0760—
Simple Link Directory < 7.7.2 - Unauthenticated SQL injection
23RISK
open ↗
Nucleimedium
WordPress Loco Translate < 2.6.1 - Cross-Site Scripting
CVE-2022-0765—
Loco Translate < 2.6.1 - Authenticated Stored Cross-Site Scripting
18RISK
open ↗
Nucleicritical
Users Ultra <= 3.1.0 - SQL Injection
CVE-2022-0769—
Users Ultra <= 3.1.0 - Unauthenticated SQL Injection
18RISK
open ↗
Nucleicritical
Documentor <= 1.5.3 - Unauthenticated SQL Injection
CVE-2022-0773—
Documentor <= 1.5.3 - Unauthenticated SQLi
30RISK
open ↗
Nucleimedium
RevealJS postMessage <4.3.0 - Cross-Site Scripting
CVE-2022-0776MEDIUM
Cross-site Scripting (XSS) - DOM in hakimel/reveal.js
28RISK
open ↗
Nucleicritical
WordPress Nirweb Support <2.8.2 - SQL Injection
CVE-2022-0781—
Nirweb support < 2.8.2 - Unauthenticated SQLi
23RISK
open ↗
Nucleihigh
Multiple Shipping Address Woocommerce < 2.0 - SQL Injection
CVE-2022-0783—
Multiple Shipping Address Woocommerce < 2.0 - Unauthenticated SQLi
18RISK
open ↗
Nucleicritical
WordPress Title Experiments Free <9.0.1 - SQL Injection
CVE-2022-0784—
Title Experiments Free < 9.0.1 - Unauthenticated SQLi
23RISK
open ↗
Nucleicritical
WordPress Daily Prayer Time <2022.03.01 - SQL Injection
CVE-2022-0785—
Daily Prayer Time < 2022.03.01 - Unauthenticated SQLi
18RISK
open ↗
Nucleicritical
WordPress KiviCare <2.3.9 - SQL Injection
CVE-2022-0786—
KiviCare < 2.3.9 - Unauthenticated SQLi
23RISK
open ↗
Nucleicritical
Limit Login Attempts (Spam Protection) < 5.1 - SQL Injection
CVE-2022-0787—
Limit Login Attempts (Spam Protection) < 5.1 - Unauthenticated SQLi
18RISK
open ↗
← previouspage 118 / 151next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.