Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,111cataloged exploits
40,153CVEs with public exploitation
24,696lab-tested
AllReferência 26,040Exploit-DB 24,488GitHub PoC 17,566VulnCheck XDB 9,945Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
4,542 exploits
Nucleicritical
SPIP Porte Plume Plugin - Remote Code Execution
SPIP porte_plume Plugin Arbitrary PHP Execution
85RISK
open ↗Nucleihigh
WordPress Clean Login <= 1.14.5 Authenticated (Contributor+) - Local File Inclusion
Clean Login <= 1.14.5 - Authenticated (Contributor+) Local File Inclusion
36RISK
open ↗Nucleicritical
GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection
75RISK
open ↗Nucleicritical
WooCommerce Ultimate Gift Card ≤ 2.6.0 - Arbitrary File Upload
WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload
63RISK
open ↗Nucleicritical
JSONPath Plus < 10.3.0 - Remote Code Execution
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input
68RISK
open ↗Nucleimedium
Plugin Oficial – Getnet para WooCommerce <= 1.8.0 - Cross-Site Scripting
Plugin Oficial – Getnet para WooCommerce <= 1.7.3 - Unauthenticated Reflected XSS
28RISK
open ↗Nucleihigh
WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection
WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function
36RISK
open ↗Nucleihigh
WP-Recall – Plugin <= 16.26.10 - Unauthenticated SQL Injection
WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL Injection
36RISK
open ↗Nucleicritical
Twonky Server 8.5.2 on Linux and Windows - Log File Exposure
Unauthenticated log access in Twonky Server
75RISK
open ↗Nucleihigh
Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read
Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read
36RISK
open ↗Nucleicritical
DynamiApps Frontend Admin <= 3.28.20 - Unauthenticated Arbitrary Options Update
Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
63RISK
open ↗Nucleicritical
NUUO Camera <=20250203 - OS Command Injection
NUUO Camera handle_config.php print_file command injection
60RISK
open ↗Nucleicritical
WP Directory Kit <= 1.4.4 - Authentication Bypass
WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover
63RISK
open ↗Nucleimedium
Responsive Pricing Table <= 5.1.12 - Cross-Site Scripting
Responsive Pricing Table <= 5.1.12 - Authenticated (Author+) Stored Cross-Site Scripting
28RISK
open ↗Nucleicritical
Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
75RISK
open ↗Nucleimedium
Feedback Modal for Website <= 1.0.1 - Unauthenticated Feedback Export
Feedback Modal for Website <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Feedback Data Exfiltration via 'export_data' Parameter
28RISK
open ↗Nucleihigh
IP2Location Country Blocker < 2.38.9 - Unauthenticated Information Disclosure
IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function
36RISK
open ↗Nucleicritical
WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection
CBX Bookmark & Favorite <= 2.0.4 - Authenticated (Subscriber+) SQL Injection via `orderby` Parameter
28RISK
open ↗Nucleicritical
WordPress Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Remote Code Execution
Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Execution
43RISK
open ↗Nucleihigh
Yoco Payments <= 3.8.8 - Path Traversal
Yoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read
36RISK
open ↗Nucleimedium
WP Directory Kit < 1.5.0 - Unauthenticated Email Exposure
WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action
28RISK
open ↗Nucleimedium
LearnPress < 4.3.2 - Broken Access Control
LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure
28RISK
open ↗Nucleimedium
User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion
WP User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
28RISK
open ↗Nucleihigh
Team WordPress Plugin (TLP Team) <= 5.0.9 - SQL Injection
Team < 5.0.11 - Unauthenticated SQLi
36RISK
open ↗Nucleimedium
Premium Addons for Elementor - Unauthenticated Information Disclosure
Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'
28RISK
open ↗Nucleihigh
Payara Server - Cross-Site Scripting
Admin Account Takeover via malicious URL payload
36RISK
open ↗Nucleihigh
WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File
Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File
36RISK
open ↗Nucleihigh
D-Link DIR-803 - Authentication Bypass
D-Link DIR-803 Configuration getcfg.php information disclosure
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.