Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,445cataloged exploits
34,432CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,497GitHub PoC 13,627VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
4,217 exploits
Nucleicritical
Quiz and Survey Master <= 8.1.4 - SQL Injection
CVE-2023-28787CRITICAL
WordPress Quiz And Survey Master plugin <= 8.1.4 - Unauthenticated SQL Injection vulnerability
43RISK
open ↗
Nucleihigh
ManageEngine ADManager Plus - Command Injection
CVE-2023-29084HIGH
Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy setti
58RISK
open ↗
Nucleimedium
XWiki - Open Redirect
CVE-2023-29204MEDIUM
URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcore
28RISK
open ↗
Nucleihigh
Adobe ColdFusion - Access Control Bypass
CVE-2023-29298HIGHunder attack
Adobe ColdFusion Improper Access Control Security feature bypass
88RISK
open ↗
Nucleicritical
Adobe ColdFusion - Pre-Auth Remote Code Execution
CVE-2023-29300CRITICALunder attackransomware
Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
95RISK
open ↗
Nucleicritical
Microsoft SharePoint - Authentication Bypass
CVE-2023-29357CRITICALunder attackransomware
Microsoft SharePoint Server Elevation of Privilege Vulnerability
100RISK
open ↗
Nucleimedium
FooGallery plugin <= 2.2.35 - Cross-Site Scripting
CVE-2023-29439HIGH
WordPress FooGallery Plugin <= 2.2.35 is vulnerable to Cross Site Scripting (XSS)
36RISK
open ↗
Nucleimedium
OpenEMR < 7.0.1 - Cross-Site Scripting
CVE-2023-2948HIGH
Cross-site Scripting (XSS) - Generic in openemr/openemr
58RISK
open ↗
Nucleimedium
cPanel < 11.109.9999.116 - Cross-Site Scripting
CVE-2023-29489MEDIUM
An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall
40RISK
open ↗
Nucleimedium
OpenEMR < 7.0.1 - Cross-site Scripting
CVE-2023-2949HIGH
Cross-site Scripting (XSS) - Reflected in openemr/openemr
36RISK
open ↗
Nucleimedium
XWiki >= 13.10.8 - Cross-Site Scripting
CVE-2023-29506MEDIUM
org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints
28RISK
open ↗
Nucleimedium
Purchase Order Management v1.0 - Cross Site Scripting (Reflected)
CVE-2023-29623MEDIUM
Purchase Order Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the pa
28RISK
open ↗
Nucleicritical
Miniorange Social Login and Register <= 7.6.3 - Authentication Bypass
CVE-2023-2982CRITICAL
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass
75RISK
open ↗
Nucleicritical
Embedded JavaScript(EJS) 3.1.6 - Template Injection
CVE-2023-29827CRITICAL
ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be i
43RISK
open ↗
Nucleihigh
Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion
CVE-2023-29887HIGH
A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitra
36RISK
open ↗
Nucleicritical
SolarView Compact <= 6.00 - Local File Inclusion
CVE-2023-29919CRITICAL
SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. Any file on the server can be read or modified because t
75RISK
open ↗
Nucleimedium
PowerJob V4.3.1 - Authentication Bypass
CVE-2023-29922MEDIUM
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.
28RISK
open ↗
Nucleimedium
PowerJob <=4.3.2 - Unauthenticated Access
CVE-2023-29923MEDIUM
PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface.
28RISK
open ↗
Nucleicritical
TOTOLink - Unauthenticated Command Injection
CVE-2023-30013CRITICAL
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/s
68RISK
open ↗
Nucleimedium
Imgproxy <= 3.14.0 - Server-side request forgery (SSRF)
CVE-2023-30019MEDIUM
imgproxy <=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL para
28RISK
open ↗
Nucleicritical
PrestaShop leocustomajax 1.0 & 1.0.0 - SQL Injection
CVE-2023-30150CRITICAL
PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.
43RISK
open ↗
Nucleicritical
PrestaShop 'possearchproducts' <= 1.7 - SQL Injection
CVE-2023-30192CRITICAL
Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find().
43RISK
open ↗
Nucleicritical
Prestashop posstaticfooter <= 1.0.0 - SQL Injection
CVE-2023-30194CRITICAL
Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().
55RISK
open ↗
Nucleimedium
OURPHP <= 7.2.0 - Cross Site Scripting
CVE-2023-30210MEDIUM
OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php.
28RISK
open ↗
Nucleimedium
OURPHP <= 7.2.0 - Cross Site Scripting
CVE-2023-30212MEDIUM
OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.
28RISK
open ↗
Nucleimedium
Webkul QloApps 1.5.2 - Cross-site Scripting
CVE-2023-30256MEDIUM
Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive informat
48RISK
open ↗
Nucleicritical
MagnusBilling - Remote Code Execution
CVE-2023-30258CRITICAL
Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary com
85RISK
open ↗
Nucleimedium
Cacti < 1.2.25 Insecure Deserialization
CVE-2023-30534MEDIUM
Insecure Deserialization in Cacti
28RISK
open ↗
Nucleihigh
Rudder Server < 1.3.0-rc.1 - SQL Injection
CVE-2023-30625HIGH
rudder-server vulnerable to SQL Injection
58RISK
open ↗
Nucleicritical
MStore API < 3.9.8 - SQL Injection
CVE-2023-3077—
MStore API < 3.9.8 - Unauthenticated Blind SQLi
18RISK
open ↗
← previouspage 126 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.