Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,883cataloged exploits

40,037CVEs with public exploitation

24,696lab-tested

All Referência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecent popular risk

4,527 exploits

Nucleicritical

QNAP QTS Photo Station External Reference - Local File Inclusion

CVE-2022-27593CRITICALunder attackransomware

DeadBolt Ransomware

95RISK

open ↗

Nucleihigh

WordPress Simple Ajax Chat <20220116 - Sensitive Information Disclosure vulnerability

CVE-2022-27849MEDIUM

WordPress Simple Ajax Chat plugin <= 20220115 - Sensitive Information Disclosure vulnerability

28RISK

open ↗

Nucleihigh

Zimbra Collaboration Suite - Memcached Command Injection

CVE-2022-27924CRITICALunder attackransomware

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands i

95RISK

open ↗

Nucleihigh

Zimbra Collaboration Suite 8.8.15/9.0 - Zip Path Traversal

CVE-2022-27925HIGHunder attackransomware

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts file

100RISK

open ↗

Nucleimedium

Zimbra Collaboration (ZCS) - Cross Site Scripting

CVE-2022-27926MEDIUMunder attack

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboratio

63RISK

open ↗

Nucleicritical

Microfinance Management System 1.0 - SQL Injection

CVE-2022-27927—

A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application d

23RISK

open ↗

Nucleicritical

Cuppa CMS v1.0 - SQL injection

CVE-2022-27984—

CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu_filter parameter at /administrator/te

18RISK

open ↗

Nucleicritical

Cuppa CMS v1.0 - SQL injection

CVE-2022-27985—

CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.

18RISK

open ↗

Nucleicritical

Atom CMS v2.0 - SQL Injection

CVE-2022-28032—

AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_pages.php

18RISK

open ↗

Nucleicritical

Atom.CMS 2.0 - SQL Injection

CVE-2022-28033—

Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_uploads.php

18RISK

open ↗

Nucleihigh

College Management System 1.0 - SQL Injection

CVE-2022-28079—

College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter.

43RISK

open ↗

Nucleihigh

SpaceLogic C-Bus Home Controller <=1.31.460 - Remote Command Execution

CVE-2022-34753HIGH

A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exist

78RISK

open ↗

Nucleicritical

WordPress tagDiv Composer < 3.5 - Authentication Bypass

CVE-2022-3477CRITICAL

tagDiv Composer < 3.5 - Unauthenticated Account Takeover

43RISK

open ↗

Nucleicritical

NotificationX Dropshipping < 4.4 - SQL Injection

CVE-2022-3481CRITICAL

WooCommerce Dropshipping < 4.4 - Unauthenticated SQLi

63RISK

open ↗

Nucleimedium

WordPress WPB Show Core - Cross-Site Scripting

CVE-2022-3484MEDIUM

WPB Show Core - Reflected Cross-Site Scripting

28RISK

open ↗

Nucleimedium

WordPress Related Posts <2.1.3 - Stored Cross-Site Scripting

CVE-2022-3506MEDIUM

Cross-site Scripting (XSS) - Stored in barrykooij/related-posts-for-wp

28RISK

open ↗

Nucleimedium

kkFileView 4.1.0 - Cross-Site Scripting

CVE-2022-35151—

kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and current

18RISK

open ↗

Nucleicritical

Zoho ManageEngine - Remote Code Execution

CVE-2022-35405CRITICALunder attack

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code

100RISK

open ↗

Nucleicritical

WAPPLES Web Application Firewall <=6.0 - Hardcoded Credentials

CVE-2022-35413—

WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configur

23RISK

open ↗

Nucleimedium

H3C SSL VPN <=2022-07-10 - Cross-Site Scripting

CVE-2022-35416—

H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS.

18RISK

open ↗

Nucleimedium

eShop 3.0.4 - Cross-Site Scripting

CVE-2022-35493MEDIUM

A Cross-site scripting (XSS) vulnerability in json search parse and the json response in wrteam.in, eShop - Multipurpose

28RISK

open ↗

Nucleihigh

Proxmox - CRLF Injection

CVE-2022-35507MEDIUM

A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) w

28RISK

open ↗

Nucleimedium

Moodle LTI module Reflected - Cross-Site Scripting

CVE-2022-35653—

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitizat

18RISK

open ↗

Nucleimedium

WordPress ProfileGrid <5.1.1 - Cross-Site Scripting

CVE-2022-3578MEDIUM

ProfileGrid < 5.1.1 - Reflected Cross-Site Scripting

28RISK

open ↗

Nucleimedium

WordPress <= 6.2 - Server Side Request Forgery

CVE-2022-3590MEDIUM

WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding

48RISK

open ↗

Nucleicritical

GLPI <=10.0.2 - Remote Command Execution

CVE-2022-35914CRITICALunder attack

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

100RISK

open ↗

Nucleicritical

Webmin <1.997 - Authenticated Remote Code Execution

CVE-2022-36446—

software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.

60RISK

open ↗

Nucleihigh

ZK Framework - Information Disclosure

CVE-2022-36537HIGHunder attackransomware

ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafte

100RISK

open ↗

Nucleicritical

Hytec Inter HWL-2511-SS - Remote Command Execution

CVE-2022-36553—

Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /w

60RISK

open ↗

Nucleicritical

Omnia MPX 1.5.0+r1 - Local File Inclusion

CVE-2022-36642—

A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.0.0-1.4.9 all

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.