Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
4,542 exploits
Nucleihigh
Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS
Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint
36RISK
open ↗Nucleicritical
FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
68RISK
open ↗Nucleimedium
Discourse - Unauthenticated Mailpace Webhook Bounce-Score Forgery
Discourse doesn't ensure webhooks require a token
28RISK
open ↗Nucleihigh
MLflow <= 3.9.0 - Arbitrary File Read
Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow
36RISK
open ↗Nucleicritical
Milvus - Unauthenticated Metrics API Access
Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise
75RISK
open ↗Nucleicritical
Crawl4AI < 0.8.0 - Unauthenticated Remote Code Execution via Hooks Parameter
Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter
63RISK
open ↗Nucleicritical
Crawl4AI < 0.8.0 - Local File Inclusion
Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling
43RISK
open ↗Nucleihigh
Discourse - Private User Field Disclosure via Directory Items IDOR
Discourse has IDOR vulnerability in the directory items endpoint
36RISK
open ↗Nucleihigh
Tattile Camera < 1.181.5 - Default Login
Tattile Smart+ / Vega / Basic <= 1.181.5 Default Credentials
63RISK
open ↗Nucleimedium
Hoppscotch <= 2026.2.1 - Open Redirect
hoppscotch: Open redirect via `/enter?redirect=`
28RISK
open ↗Nucleihigh
WordPress Media Library Assistant <= 3.34 - SQL Injection
WordPress Media LIbrary Assistant plugin <= 3.34 - SQL Injection vulnerability
36RISK
open ↗Nucleicritical
UniFi OS - Authentication Bypass via Path Traversal (..%2f)
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS de
100RISK
open ↗Nucleicritical
UniFi OS Server - Command Injection
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS
100RISK
open ↗Nucleicritical
Dgraph <=v25.3.0 - Admin Mutation Missing Authorization
Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
43RISK
open ↗Nucleihigh
LiteLLM - Arbitrary File Read
LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint
68RISK
open ↗Nucleihigh
Ech0 < 4.2.8 - Server-Side Request Forgery
Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata
56RISK
open ↗Nucleicritical
Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mana
100RISK
open ↗Nucleihigh
FortiClient EMS - Authentication Bypass
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated atta
100RISK
open ↗Nucleihigh
Planyo Online Reservation System <= 3.0 - Arbitrary File Read
Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter
56RISK
open ↗Nucleicritical
WordPress Kali Forms <= 2.4.9 - Remote Code Execution
Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process
63RISK
open ↗Nucleicritical
dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal
Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execut
43RISK
open ↗Nucleihigh
dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks
Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-u
36RISK
open ↗Nucleicritical
Breeze <= 2.4.4 - Arbitrary File Upload
Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
68RISK
open ↗Nucleicritical
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
75RISK
open ↗Nucleicritical
ChurchCRM - API Authentication Bypass via URL Injection
ChurchCRM has an API Authentication Bypass
43RISK
open ↗Nucleimedium
Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal
Frappe has an Arbitrary File Read via Path Traversal in render_include
36RISK
open ↗Nucleihigh
Vite Dev Server - Directory Traversal
Vite has a `server.fs.deny` bypass with queries
36RISK
open ↗Nucleimedium
Vite Dev Server - Path Traversal in Optimized Deps .map Handling
Vite has a Path Traversal in Optimized Deps `.map` Handling
28RISK
open ↗Nucleihigh
Meta Box <= 5.11.1 - Arbitrary File Deletion
WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion vulnerability
28RISK
open ↗Nucleicritical
Fortinet FortiSandbox - Command Injection
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.