Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,883cataloged exploits
40,037CVEs with public exploitation
24,696lab-tested
AllReferência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
4,527 exploits
Nucleimedium
Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting
Image Optimizer by 10web < 1.0.27 - Reflected Cross-Site Scripting
18RISK
open ↗Nucleicritical
Purchase Order Management v1.0 - SQL Injection
SourceCodester Purchase Order Management System GET Parameter view_details.php sql injection
28RISK
open ↗Nucleimedium
Aajoda Testimonials < 2.2.2 - Cross-Site Scripting
Aajoda Testimonials < 2.2.2 - Admin+ Stored XSS
18RISK
open ↗Nucleihigh
Oracle Peoplesoft - Unauthenticated File Read
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported vers
58RISK
open ↗Nucleimedium
Adobe Connect < 12.1.5 - Local File Disclosure
Adobe Connect Improper Access Control Security feature bypass
70RISK
open ↗Nucleimedium
Seo By 10Web < 1.2.7 - Cross-Site Scripting
Seo By 10Web < 1.2.7 - Admin+ Stored XSS
28RISK
open ↗Nucleicritical
Modoboa < 2.1.0 - Improper Authorization
Improper Authorization in modoboa/modoboa
55RISK
open ↗Nucleimedium
Web2py URL - Open Redirect
Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirec
28RISK
open ↗Nucleicritical
KubePi JwtSigKey - Admin Authentication Bypass
KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token
55RISK
open ↗Nucleihigh
KubePi <= v1.6.4 LoginLogsSearch - Unauthorized Access
KubePi is vulnerable to missing authorization
36RISK
open ↗Nucleicritical
KubeOperator Foreground `kubeconfig` - File Download
KubeOperator is vulnerable to unauthorized access to system API
48RISK
open ↗Nucleicritical
Atlassian Confluence - Privilege Escalation
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited
100RISK
open ↗Nucleicritical
Atlassian Confluence Server - Improper Authorization
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authoriz
100RISK
open ↗Nucleicritical
Atlassian Confluence - Remote Code Execution
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated atta
100RISK
open ↗Nucleihigh
WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting
Product Addons & Fields for WooCommerce < 32.0.7 - Reflected Cross-Site Scripting
18RISK
open ↗Nucleihigh
SecurePoint UTM 12.x Session ID Leak
An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows sessionid infor
36RISK
open ↗Nucleihigh
Strapi Versions <=4.5.5 - SSTI to Remote Code Execution
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitra
85RISK
open ↗Nucleimedium
Tiempo.com <= 0.1.2 - Cross-Site Scripting
Tiempo.com <= 0.1.2 - Reflected XSS
18RISK
open ↗Nucleihigh
Strapi Versions <=4.5.6 - Authentication Bypass
Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login pro
36RISK
open ↗Nucleimedium
Securepoint UTM - Leaking Remote Memory Contents
An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows information dis
28RISK
open ↗Nucleihigh
SugarCRM Unauthenticated - Remote Code Execution
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because o
100RISK
open ↗Nucleihigh
Cellinx NVT Web Server - Local File Disclosure
Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFi
38RISK
open ↗Nucleimedium
wpForo Forum <= 2.1.8 - Cross-Site Scripting
wpForo Forum < 2.1.9 - Reflected Cross-Site Scripting
18RISK
open ↗Nucleimedium
Art Gallery Management System Project v1.0 - Cross-Site Scripting
A reflected cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to e
38RISK
open ↗Nucleicritical
SolarView Compact 6.00 - OS Command Injection
There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassin
85RISK
open ↗Nucleicritical
WordPress Paid Memberships Pro <2.9.8 - Blind SQL Injection
The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerabilit
85RISK
open ↗Nucleicritical
WordPress Easy Digital Downloads 3.1.0.2/3.1.0.3 - SQL Injection
The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection
48RISK
open ↗Nucleimedium
Quick Event Manager < 9.7.5 - Cross-Site Scripting
The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability
28RISK
open ↗Nucleihigh
Login with Phone Number - Cross-Site Scripting
The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerabili
48RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.