Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,445cataloged exploits

34,432CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,497GitHub PoC 13,627VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecent popular risk

4,217 exploits

Nucleihigh

WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection

CVE-2022-0651CRITICAL

WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type

55RISK

open ↗

Nucleimedium

Wordpress Profile Builder Plugin Cross-Site Scripting

CVE-2022-0653MEDIUM

Profile Builder – User Profile & User Registration Forms <= 3.6.1 Reflected Cross-Site Scripting

28RISK

open ↗

Nucleihigh

uDraw <3.3.3 - Local File Inclusion

CVE-2022-0656—

uDraw < 3.3.3 - Unauthenticated Arbitrary File Access

18RISK

open ↗

Nucleicritical

CommonsBooking < 2.6.8 - SQL Injection

CVE-2022-0658—

CommonsBooking < 2.6.8 - Unauthenticated SQL Injection

18RISK

open ↗

Nucleihigh

Microweber <1.2.11 - Information Disclosure

CVE-2022-0660CRITICAL

Generation of Error Message Containing Sensitive Information in microweber/microweber

43RISK

open ↗

Nucleihigh

Microweber < 1.2.11 - CRLF Injection

CVE-2022-0666HIGH

CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in microweber/microweber

48RISK

open ↗

Nucleimedium

Microweber <1.2.11 - Cross-Site Scripting

CVE-2022-0678MEDIUM

Cross-site Scripting (XSS) - Reflected in microweber/microweber

28RISK

open ↗

Nucleicritical

WordPress Narnoo Distributor <=2.5.1 - Local File Inclusion

CVE-2022-0679—

Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCE

30RISK

open ↗

Nucleimedium

Rudloff alltube prior to 3.0.1 - Open Redirect

CVE-2022-0692MEDIUM

Open Redirect on Rudloff/alltube in rudloff/alltube

28RISK

open ↗

Nucleicritical

WordPress Master Elements <=8.0 - SQL Injection

CVE-2022-0693—

Master Elements <= 8.0 - Unauthenticated SQLi

18RISK

open ↗

Nucleicritical

GitLab CE/EE - Information Disclosure

CVE-2022-0735CRITICAL

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star

48RISK

open ↗

Nucleicritical

Infographic Maker iList < 4.3.8 - SQL Injection

CVE-2022-0747—

Infographic Maker - iList < 4.3.8 - Unauthenticated SQL Injection

23RISK

open ↗

Nucleicritical

WordPress Simple Link Directory <7.7.2 - SQL injection

CVE-2022-0760—

Simple Link Directory < 7.7.2 - Unauthenticated SQL injection

23RISK

open ↗

Nucleimedium

WordPress Loco Translate < 2.6.1 - Cross-Site Scripting

CVE-2022-0765—

Loco Translate < 2.6.1 - Authenticated Stored Cross-Site Scripting

18RISK

open ↗

Nucleicritical

Users Ultra <= 3.1.0 - SQL Injection

CVE-2022-0769—

Users Ultra <= 3.1.0 - Unauthenticated SQL Injection

18RISK

open ↗

Nucleicritical

Documentor <= 1.5.3 - Unauthenticated SQL Injection

CVE-2022-0773—

Documentor <= 1.5.3 - Unauthenticated SQLi

30RISK

open ↗

Nucleimedium

RevealJS postMessage <4.3.0 - Cross-Site Scripting

CVE-2022-0776MEDIUM

Cross-site Scripting (XSS) - DOM in hakimel/reveal.js

28RISK

open ↗

Nucleicritical

WordPress Nirweb Support <2.8.2 - SQL Injection

CVE-2022-0781—

Nirweb support < 2.8.2 - Unauthenticated SQLi

23RISK

open ↗

Nucleihigh

Multiple Shipping Address Woocommerce < 2.0 - SQL Injection

CVE-2022-0783—

Multiple Shipping Address Woocommerce < 2.0 - Unauthenticated SQLi

18RISK

open ↗

Nucleicritical

WordPress Title Experiments Free <9.0.1 - SQL Injection

CVE-2022-0784—

Title Experiments Free < 9.0.1 - Unauthenticated SQLi

23RISK

open ↗

Nucleicritical

Oracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution

CVE-2022-21587CRITICALunder attackransomware

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).

100RISK

open ↗

Nucleihigh

WordPress <5.8.3 - SQL Injection

CVE-2022-21661HIGH

SQL injection in WordPress

78RISK

open ↗

Nucleimedium

WordPress Download Manager < 3.2.44 - Authenticated Cross-Site Scripting

CVE-2022-2168—

Download Manager < 3.2.44 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleihigh

October CMS - Remote Code Execution

CVE-2022-21705HIGH

Authenticated remote code execution in octobercms

36RISK

open ↗

Nucleimedium

microweber 1.2.18 - Cross-site Scripting

CVE-2022-2174MEDIUM

Cross-site Scripting (XSS) - Reflected in microweber/microweber

28RISK

open ↗

Nucleihigh

GitLab CE/EE - Remote Code Execution

CVE-2022-2185CRITICAL

A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to

85RISK

open ↗

Nucleimedium

WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting

CVE-2022-2187—

Contact Form 7 Captcha < 0.1.2 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleihigh

Unyson < 2.7.27 - Cross Site Scripting

CVE-2022-2219—

Unyson < 2.7.27 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

Juniper Web Device Manager - Cross-Site Scripting

CVE-2022-22242MEDIUM

Junos OS: Cross-site Scripting (XSS) vulnerability in J-Web

48RISK

open ↗

Nucleicritical

SAP Memory Pipes (MPI) Desynchronization

CVE-2022-22536CRITICALunder attack

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and

100RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.