Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,883cataloged exploits

40,037CVEs with public exploitation

24,696lab-tested

All Referência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecent popular risk

4,527 exploits

Nucleimedium

Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting

CVE-2021-26710—

A cross-site scripting (XSS) issue in the login panel in Redwood Report2Web 4.3.4.5 and 4.5.3 allows remote attackers to

18RISK

open ↗

Nucleicritical

Microsoft Exchange Server SSRF Vulnerability

CVE-2021-26855CRITICALunder attackransomware

Microsoft Exchange Server Remote Code Execution Vulnerability

100RISK

open ↗

Nucleimedium

Doctor Appointment System 1.0 - SQL Injection

CVE-2021-27124—

SQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0 allows an authenticated

18RISK

open ↗

Nucleimedium

Clansphere CMS 2011.4 - Cross-Site Scripting

CVE-2021-27310—

Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "language" parameter.

18RISK

open ↗

Nucleicritical

Doctor Appointment System 1.0 - SQL Injection

CVE-2021-27314—

SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL q

23RISK

open ↗

Nucleihigh

Doctor Appointment System 1.0 - SQL Injection

CVE-2021-27319—

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malic

18RISK

open ↗

Nucleihigh

Doctor Appointment System 1.0 - SQL Injection

CVE-2021-27320—

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malic

18RISK

open ↗

Nucleihigh

Grafana Unauthenticated Snapshot Creation

CVE-2021-27358—

The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of

40RISK

open ↗

Nucleicritical

Pega Infinity - Authentication Bypass

CVE-2021-27651CRITICAL

In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to byp

75RISK

open ↗

Nucleicritical

Appspace 6.2.4 - Server-Side Request Forgery

CVE-2021-27670—

Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter.

30RISK

open ↗

Nucleicritical

LumisXP <10.0.0 - Blind XML External Entity Attack

CVE-2021-27931—

LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControl

23RISK

open ↗

Nucleicritical

SonLogger - Arbitrary File Upload

CVE-2021-27964—

SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Con

50RISK

open ↗

Nucleimedium

Eclipse Jetty - Information Disclosure

CVE-2021-28164MEDIUM

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contai

70RISK

open ↗

Nucleimedium

Eclipse Jetty ConcatServlet - Information Disclosure

CVE-2021-28169MEDIUM

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doub

50RISK

open ↗

Nucleihigh

Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure

CVE-2021-28937—

The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) conta

18RISK

open ↗

Nucleimedium

rConfig 3.9.6 - Local File Inclusion

CVE-2021-29006—

rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any

18RISK

open ↗

Nucleihigh

LDAP Injection In OpenAM

CVE-2021-29156—

ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacke

60RISK

open ↗

Nucleicritical

Apache OFBiz < 17.12.07 - Arbitrary Code Execution

CVE-2021-29200—

RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI

30RISK

open ↗

Nucleimedium

SysAid Technologies 20.3.64 b14 - Cross-Site Scripting

CVE-2021-30049—

SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI.

18RISK

open ↗

Nucleicritical

Kaseya VSA < 9.5.7 - Credential Disclosure via Windows Agent

CVE-2021-30116CRITICALunder attackransomware

Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6

95RISK

open ↗

Nucleicritical

Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Execution

CVE-2021-30118CRITICAL

Unauthenticated Remote Code Execution in Kaseya VSA < v9.5.5

55RISK

open ↗

Nucleicritical

Apache OFBiz <17.12.07 - Arbitrary Code Execution

CVE-2021-30128—

Unsafe deserialization in Apache OFBiz

60RISK

open ↗

Nucleimedium

Php-mod/curl Library <2.3.2 - Cross-Site Scripting

CVE-2021-30134MEDIUM

php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key paramet

28RISK

open ↗

Nucleicritical

PrestaShop 1.7.7.0 - SQL Injection

CVE-2021-3110—

The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller

23RISK

open ↗

Nucleicritical

CentOS Web Panel - SQL Injection

CVE-2021-31316—

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST param

23RISK

open ↗

Nucleimedium

Akkadian Provisioning Manager - Information Disclosure

CVE-2021-31581HIGH

Akkadian Provisioning Manager Engine (PME) Shell Escape via 'vi' editor interface

36RISK

open ↗

Nucleimedium

BeyondTrust Secure Remote Access Base <=6.0.1 - Cross-Site Scripting

CVE-2021-31589—

A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Sof

43RISK

open ↗

Nucleimedium

WebCTRL OEM <= 6.5 - Cross-Site Scripting

CVE-2021-31682—

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for re

43RISK

open ↗

Nucleimedium

SysAid 20.4.74 - Cross-Site Scripting

CVE-2021-31862—

SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication.

18RISK

open ↗

Nucleimedium

Moodle 3.8-3.10.3 - Reflected XSS & Open Redirect

CVE-2021-32478—

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect

18RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.