Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,883cataloged exploits
40,037CVEs with public exploitation
24,696lab-tested
AllReferência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
4,531 exploits
Nucleihigh
SRS - Command Injection
SRS has command injection vulnerability in demonstration api-server for HTTP callback.
36RISK
open ↗Nucleicritical
SonicWall GMS and Analytics Web Services - Shell Injection
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authenticatio
75RISK
open ↗Nucleihigh
SonicWall GMS and Analytics - SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and
58RISK
open ↗Nucleicritical
Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary co
95RISK
open ↗Nucleimedium
Kyocera TASKalfa printer - Path Traversal
Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal to read ar
40RISK
open ↗Nucleicritical
MOVEit Transfer - Remote Code Execution
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
100RISK
open ↗Nucleicritical
WordPress Canto Plugin <= 3.0.4 - File Inclusion
Canto <= 3.0.4 - Unauthenticated Remote File Inclusion
63RISK
open ↗Nucleimedium
Hoteldruid 3.0.5 - Cross-Site Scripting
A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected web
18RISK
open ↗Nucleicritical
Gibbon v25.0.0 - Local File Inclusion
Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files
50RISK
open ↗Nucleimedium
Gibbon v25.0.0 - Cross-Site Scripting
Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to ex
18RISK
open ↗Nucleicritical
Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation
Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation
60RISK
open ↗Nucleicritical
JeecgBoot 3.5.0 - SQL Injection
jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interfac
23RISK
open ↗Nucleicritical
bloofoxCMS v0.5.2.1 - SQL Injection
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the gid parameter at admin/index.php?mode=u
43RISK
open ↗Nucleicritical
bloofoxCMS v0.5.2.1 - SQL Injection
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the lid parameter at admin/index.php?mode=s
43RISK
open ↗Nucleicritical
bloofoxCMS v0.5.2.1 - SQL Injection
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the tid parameter at admin/index.php?mode=s
43RISK
open ↗Nucleicritical
Bloofox v0.5.2.1 - SQL Injection
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the pid parameter at admin/index.php?mode=s
43RISK
open ↗Nucleicritical
bloofoxCMS v0.5.2.1 - SQL Injection
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the userid parameter at admin/index.php?mod
43RISK
open ↗Nucleicritical
Bloofox v0.5.2.1 - SQL Injection
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=s
43RISK
open ↗Nucleimedium
Hestiacp <= 1.7.7 - Cross-Site Scripting
Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp
28RISK
open ↗Nucleihigh
Traggo Server - Local File Inclusion
Traggo Server 0.3.0 is vulnerable to directory traversal via a crafted GET request.
18RISK
open ↗Nucleicritical
Chamilo Command Injection
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to ex
60RISK
open ↗Nucleicritical
FortiWLM - Directory Traversal
A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to ex
48RISK
open ↗Nucleicritical
Fortinet FortiWLM Unauthenticated Command Injection Vulnerability
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM versio
48RISK
open ↗Nucleicritical
Ivanti Endpoint Manager Mobile (EPMM) - Authentication Bypass
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or re
100RISK
open ↗Nucleicritical
MobileIron Core - Remote Unauthenticated API Access
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted fu
100RISK
open ↗Nucleimedium
XWiki - Cross-Site Scripting
XWiki Platform vulnerable to cross-site scripting in target parameter via share page by email
36RISK
open ↗Nucleimedium
XWiki >= 6.0-rc-1 - Cross-Site Scripting
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template
43RISK
open ↗Nucleimedium
XWiki - Cross-Site Scripting
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template
43RISK
open ↗Nucleimedium
XWiki >= 3.4-milestone-1 - Cross-Site Scripting
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template
43RISK
open ↗Nucleicritical
WBCE 1.6.0 - SQL Injection
SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute
18RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.