Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,445cataloged exploits

34,432CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,497GitHub PoC 13,627VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecent popular risk

4,217 exploits

Nucleicritical

WordPress WPB Show Core <= 2.2 - Server-Side Request Forgery

CVE-2023-5974—

WPB Show Core <= 2.2 - Unauthenticated Server Side Request Forgery

18RISK

open ↗

Nucleicritical

Hotel Booking Lite < 4.8.5 - Arbitrary File Download & Deletion

CVE-2023-5991—

Hotel Booking Lite < 4.8.5 - Unauthenticated Arbitrary File Download & Deletion

18RISK

open ↗

Nucleimedium

WordPress Popup Builder <= 4.2.3 - Unauthenticated Stored XSS

CVE-2023-6000MEDIUM

Popup Builder < 4.2.3 - Unauthenticated Stored XSS

48RISK

open ↗

Nucleicritical

Mlflow - Arbitrary File Write

CVE-2023-6018CRITICAL

MLflow Arbitrary File Write

55RISK

open ↗

Nucleihigh

Ray Static File - Local File Inclusion

CVE-2023-6020HIGH

Ray Static File Local File Include

41RISK

open ↗

Nucleihigh

Ray API - Local File Inclusion

CVE-2023-6021HIGH

Ray Log File Local File Include

48RISK

open ↗

Nucleihigh

VertaAI ModelDB - Path Traversal

CVE-2023-6023HIGH

ModelDB Local File Include

36RISK

open ↗

Nucleicritical

LogDash Activity Log <= 1.1.3 - SQL Injection

CVE-2023-6030MEDIUM

LogDash Activity Log < 1.1.4 - Unauthenticated SQLi

28RISK

open ↗

Nucleihigh

H2O ImportFiles - Local File Inclusion

CVE-2023-6038CRITICAL

Local File Inclusion in h2oai/h2o-3

43RISK

open ↗

Nucleihigh

WP Fastest Cache 1.2.2 - SQL Injection

CVE-2023-6063—

WP Fastest Cache < 1.2.2 - Unauthenticated SQL Injection

40RISK

open ↗

Nucleimedium

Quttera Web Malware Scanner <= 3.4.1.48 - Sensitive Data Exposure

CVE-2023-6065—

Quttera Web Malware Scanner < 3.4.2.1 - Directory Listing to Sensitive Data Exposure

23RISK

open ↗

Nucleihigh

Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure

CVE-2023-6114—

Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure

30RISK

open ↗

Nucleihigh

WordPress Backup Migration <= 1.3.6 - Path Traversal

CVE-2023-6266HIGH

Backup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure

36RISK

open ↗

Nucleimedium

TOTVS Fluig Platform - Cross-Site Scripting

CVE-2023-6275LOW

TOTVS Fluig Platform mobileredir openApp.jsp cross site scripting

23RISK

open ↗

Nucleicritical

Control iD iDSecure - Authentication Bypass

CVE-2023-6329CRITICAL

Control iD iDSecure passwordCustom Authentication Bypass

75RISK

open ↗

Nucleicritical

WordPress My Calendar <3.4.22 - SQL Injection

CVE-2023-6360HIGH

The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in th

48RISK

open ↗

Nucleimedium

OpenCMS 14 & 15 - Cross Site Scripting

CVE-2023-6379MEDIUM

Cross-site Scripting in Alkacon Software OpenCms

28RISK

open ↗

Nucleimedium

Travelpayouts <= 1.1.16 - Open Redirect

CVE-2024-0337MEDIUM

Travelpayouts <= 1.1.15 - Open Redirect

28RISK

open ↗

Nucleicritical

Likeshop < 2.5.7.20210311 - Arbitrary File Upload

CVE-2024-0352HIGH

Likeshop HTTP POST Request File.php userFormImage unrestricted upload

78RISK

open ↗

Nucleimedium

WordPress Simple Job Board - Unauthorized Data Access

CVE-2024-0593MEDIUM

Simple Job Board <= 2.10.8 - Missing Authorization to Unauthenticated Information Disclosure

28RISK

open ↗

Nucleihigh

SolarWinds Security Event Manager - Unauthenticated RCE

CVE-2024-0692HIGH

SolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability

78RISK

open ↗

Nucleicritical

Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection

CVE-2024-0705CRITICAL

Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection

43RISK

open ↗

Nucleihigh

Monitorr Services Configuration - Arbitrary File Upload

CVE-2024-0713—

15RISK

open ↗

Nucleicritical

Arcserve Unified Data Protection - Authentication Bypass

CVE-2024-0799CRITICAL

Authentication Bypass via wizardLogin in Arcserve Unified Data Protection

43RISK

open ↗

Nucleihigh

Arcserve Unified Data Protection - Unauthenticated DoS in ASNative.dll

CVE-2024-0801HIGH

Unauthenticated DoS in Arcserve Unified Data Protection

48RISK

open ↗

Nucleimedium

Combo Blocks < 2.2.76 - Improper Access Control

CVE-2024-0881MEDIUM

Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts Access

33RISK

open ↗

Nucleicritical

Smart S210 Management Platform - Arbitary File Upload

CVE-2024-0939MEDIUM

Byzoro Smart S210 Management Platform uploadfile.php unrestricted upload

40RISK

open ↗

Nucleimedium

Issabel Authenticated - Remote Code Execution

CVE-2024-0986MEDIUM

Issabel PBX Asterisk-Cli os command injection

40RISK

open ↗

Nucleicritical

CodeChecker <= 6.24.1 - Authentication Bypass

CVE-2024-10081CRITICAL

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.

55RISK

open ↗

Nucleimedium

Simple File List < 6.1.13 - Reflected Cross-Site Scripting

CVE-2024-10146MEDIUM

Simple File List < 6.1.13 - Reflected Cross-Site Scripting

28RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.