Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,883cataloged exploits
40,037CVEs with public exploitation
24,696lab-tested
AllReferência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
4,527 exploits
Nucleicritical
Online Fire Reporting System v1.0 - SQL injection
CVE-2022-31976—
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_request.
18RISK
open ↗
Nucleicritical
Online Fire Reporting System v1.0 - SQL injection
CVE-2022-31977—
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_team.
18RISK
open ↗
Nucleicritical
Online Fire Reporting System v1.0 - SQL injection
CVE-2022-31978—
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_inquiry.
18RISK
open ↗
Nucleihigh
Online Fire Reporting System v1.0 - SQL injection
CVE-2022-31984—
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/requests/take_action.php?id=.
18RISK
open ↗
Nucleihigh
Complete Online Job Search System 1.0 - SQL Injection
CVE-2022-32007—
Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/company/index.php?view=edit&id=.
18RISK
open ↗
Nucleihigh
Complete Online Job Search System 1.0 - SQL Injection
CVE-2022-32015—
Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=category&search=.
18RISK
open ↗
Nucleimedium
Academy Learning Management System <5.9.1 - Cross-Site Scripting
CVE-2022-38553MEDIUM
Academy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulner
28RISK
open ↗
Nucleicritical
Nortek Linear eMerge E3-Series - SQL Injection
CVE-2022-38627CRITICAL
Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered
43RISK
open ↗
Nucleicritical
Hospital Management System 1.0 - SQL Injection
CVE-2022-38637—
Hospital Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the Username and Pa
18RISK
open ↗
Nucleimedium
Froxlor < 0.10.38.2. - HTML Injection
CVE-2022-3869MEDIUM
Code Injection in froxlor/froxlor
28RISK
open ↗
Nucleihigh
Zaver - Local File Inclusion
CVE-2022-38794—
Zaver through 2020-12-15 allows directory traversal via the GET /.. substring.
18RISK
open ↗
Nucleimedium
AeroCMS 0.1.1 - SQL Injection
CVE-2022-38812—
AeroCMS 0.1.1 is vulnerable to SQL Injection via the author parameter.
18RISK
open ↗
Nucleihigh
Dapr Dashboard 0.1.0-0.10.0 - Improper Access Control
CVE-2022-38817—
Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitiv
18RISK
open ↗
Nucleihigh
Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)
CVE-2022-38840HIGH
cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file uplo
56RISK
open ↗
Nucleihigh
Free5gc 3.2.1 - Information Disclosure
CVE-2022-38870HIGH
Free5gc v3.2.1 is vulnerable to Information disclosure.
36RISK
open ↗
Nucleimedium
ServiceNow - Cross-site Scripting
CVE-2022-39048MEDIUM
Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirect
28RISK
open ↗
Nucleimedium
WordPress Helloprint <1.4.7 - Cross-Site Scripting
CVE-2022-3908MEDIUM
Helloprint < 1.4.7 - Reflected Cross-Site Scripting
28RISK
open ↗
Nucleimedium
LISTSERV 17 - Cross-Site Scripting
CVE-2022-39195MEDIUM
A cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary
48RISK
open ↗
Nucleimedium
Mailcow Dockerized Swagger UI - Cross-Site Scripting
CVE-2022-39258HIGH
mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI
36RISK
open ↗
Nucleimedium
WordPress Essential Real Estate <3.9.6 - Authenticated Cross-Site Scripting
CVE-2022-3933MEDIUM
Essential Real Estate < 3.9.6 - Reflected Cross-Site-Scripting
28RISK
open ↗
Nucleimedium
WordPress FlatPM <3.0.13 - Cross-Site Scripting
CVE-2022-3934MEDIUM
Flat PM < 3.0.13 - Reflected Cross-Site Scripting
28RISK
open ↗
Nucleicritical
Sophos Mobile managed on-premises - XML External Entity Injection
CVE-2022-3980CRITICAL
An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sop
43RISK
open ↗
Nucleicritical
WordPress Booking Calendar <3.2.2 - Arbitrary File Upload
CVE-2022-3982CRITICAL
Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload
63RISK
open ↗
Nucleicritical
Fortinet FortiNAC - Arbitrary File Write
CVE-2022-39952CRITICAL
A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8
85RISK
open ↗
Nucleimedium
Jira Netic Group Export <1.0.3 - Missing Authorization
CVE-2022-39960—
The Netic Group Export add-on before 1.0.3 for Atlassian Jira does not perform authorization checks. This might allow an
23RISK
open ↗
Nucleicritical
RaspAP 2.8.7 - Unauthenticated Command Injection
CVE-2022-39986—
A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary comma
60RISK
open ↗
Nucleicritical
Symmetricom SyncServer Unauthenticated - Remote Command Execution
CVE-2022-40022CRITICAL
Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.
85RISK
open ↗
Nucleicritical
Simple Task Managing System v1.0 - SQL Injection
CVE-2022-40032CRITICAL
SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' paramet
68RISK
open ↗
Nucleimedium
Flatpress < v1.2.1 - Cross Site Scripting
CVE-2022-40047—
Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter a
18RISK
open ↗
Nucleicritical
Labstack Echo 4.8.0 - Open Redirect
CVE-2022-40083CRITICAL
Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vul
43RISK
open ↗
← previouspage 124 / 151next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.