Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,883cataloged exploits
40,037CVEs with public exploitation
24,696lab-tested
AllReferência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
4,527 exploits
Nucleimedium
XWiki - Open Redirect
CVE-2023-29204MEDIUM
URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcore
28RISK
open ↗
Nucleihigh
Adobe ColdFusion - Access Control Bypass
CVE-2023-29298HIGHunder attack
Adobe ColdFusion Improper Access Control Security feature bypass
88RISK
open ↗
Nucleicritical
Adobe ColdFusion - Pre-Auth Remote Code Execution
CVE-2023-29300CRITICALunder attackransomware
Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
95RISK
open ↗
Nucleicritical
Microsoft SharePoint - Authentication Bypass
CVE-2023-29357CRITICALunder attackransomware
Microsoft SharePoint Server Elevation of Privilege Vulnerability
100RISK
open ↗
Nucleimedium
FooGallery plugin <= 2.2.35 - Cross-Site Scripting
CVE-2023-29439HIGH
WordPress FooGallery Plugin <= 2.2.35 is vulnerable to Cross Site Scripting (XSS)
36RISK
open ↗
Nucleimedium
OpenEMR < 7.0.1 - Cross-Site Scripting
CVE-2023-2948HIGH
Cross-site Scripting (XSS) - Generic in openemr/openemr
58RISK
open ↗
Nucleimedium
cPanel < 11.109.9999.116 - Cross-Site Scripting
CVE-2023-29489MEDIUM
An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall
40RISK
open ↗
Nucleimedium
OpenEMR < 7.0.1 - Cross-site Scripting
CVE-2023-2949HIGH
Cross-site Scripting (XSS) - Reflected in openemr/openemr
36RISK
open ↗
Nucleimedium
XWiki >= 13.10.8 - Cross-Site Scripting
CVE-2023-29506MEDIUM
org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints
28RISK
open ↗
Nucleicritical
Ivanti Avalanche - Remote Code Execution
CVE-2023-32563HIGH
An unauthenticated attacker could achieve the code execution through a RemoteControl server.
58RISK
open ↗
Nucleicritical
Subscribe to Category <= 2.7.4 - SQL Injection
CVE-2023-32590CRITICAL
WordPress Subscribe to Category Plugin <= 2.7.4 is vulnerable to SQL Injection
63RISK
open ↗
Nucleicritical
MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation
CVE-2023-3277CRITICAL
MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation
43RISK
open ↗
Nucleicritical
Emby Server - Authentication Bypass
CVE-2023-33193CRITICAL
Emby Server Proxy Header Spoofing Vulnerability
43RISK
open ↗
Nucleicritical
Old Age Home Management System v1.0 - SQL Injection
CVE-2023-33338CRITICAL
Old Age Home Management 1.0 is vulnerable to SQL Injection via the username parameter.
43RISK
open ↗
Nucleimedium
BlogEngine CMS - Open Redirect
CVE-2023-33405MEDIUM
Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect.
40RISK
open ↗
Nucleihigh
Faculty Evaluation System v1.0 - SQL Injection
CVE-2023-33439HIGH
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=.
36RISK
open ↗
Nucleihigh
Faculty Evaluation System v1.0 - Remote Code Execution
CVE-2023-33440HIGH
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_u
61RISK
open ↗
Nucleimedium
LMS by Masteriyo < 1.6.8 - Information Exposure
CVE-2023-3345—
LMS by Masteriyo < 1.6.8 - Information Exposure
18RISK
open ↗
Nucleihigh
Jeecg P3 Biz Chat - Local File Inclusion
CVE-2023-33510HIGH
Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.
36RISK
open ↗
Nucleihigh
Dolibarr Unauthenticated Contacts Database Theft
CVE-2023-33568—
An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's
23RISK
open ↗
Nucleihigh
H3C Magic R300-2100M - Remote Code Execution
CVE-2023-33629HIGH
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DeltriggerList interface at
36RISK
open ↗
Nucleicritical
Chamilo LMS <= v1.11.20 Unauthenticated Command Injection
CVE-2023-3368CRITICAL
Chamilo LMS Unauthenticated Command Injection
55RISK
open ↗
Nucleicritical
WAVLINK WN579X3 - Remote Command Execution
CVE-2023-3380MEDIUM
Wavlink WN579X3 Ping Test adm.cgi injection
28RISK
open ↗
Nucleicritical
FUXA - Unauthenticated Remote Code Execution
CVE-2023-33831—
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute
43RISK
open ↗
Nucleihigh
Beautiful Cookie Consent Banner < 2.10.2 - Cross-Site Scripting
CVE-2023-3388HIGH
Beautiful Cookie Consent Banner <= 2.10.1 - Unauthenticated Stored Cross-Site Scripting
58RISK
open ↗
Nucleimedium
OpenProject < 12.5.4 - Project Identifiers Exposure
CVE-2023-33960HIGH
OpenProject vulnerable to project identifier information leakage through robots.txt
36RISK
open ↗
Nucleimedium
Uncanny Toolkit for LearnDash - Open Redirection
CVE-2023-34020MEDIUM
WordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Open Redirection vulnerability
28RISK
open ↗
Nucleicritical
VMware vCenter Server - Out-of-Bounds Write
CVE-2023-34048CRITICALunder attack
VMware vCenter Server Out-of-Bounds Write Vulnerability
95RISK
open ↗
Nucleihigh
Vite Dev Server - Information Exposure
CVE-2023-34092HIGH
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
36RISK
open ↗
Nucleihigh
SRS - Command Injection
CVE-2023-34105HIGH
SRS has command injection vulnerability in demonstration api-server for HTTP callback.
36RISK
open ↗
← previouspage 126 / 151next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.