Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,320cataloged exploits

39,860CVEs with public exploitation

24,696lab-tested

All Referência 25,822Exploit-DB 24,487GitHub PoC 17,098VulnCheck XDB 9,874Nuclei 4,511Metasploit 3,528✓ verified onlyrecent popular risk

4,478 exploits

Nucleimedium

WordPress Contact Form 7 Skins <=2.5.0 - Cross-Site Scripting

CVE-2021-25063—

Contact Form 7 Skins < 2.5.1 - Reflected Cross-Site Scripting (XSS)

18RISK

open ↗

Nucleimedium

Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting

CVE-2021-25065—

Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS)

18RISK

open ↗

Nucleimedium

Landing Page Builder < 1.4.9.6 - Cross-Site Scripting

CVE-2021-25067—

Landing Page Builder < 1.4.9.6 - Authenticated Reflected Cross-Site Scripting (XSS)

18RISK

open ↗

Nucleimedium

WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirect

CVE-2021-25074—

WebP Converter for Media < 4.0.3 - Unauthenticated Open redirect

18RISK

open ↗

Nucleilow

WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting

CVE-2021-25075—

Duplicate Page or Post < 1.5.1 - Arbitrary Settings Update to Stored XSS

18RISK

open ↗

Nucleimedium

Affiliates Manager < 2.9.0 - Cross Site Scripting

CVE-2021-25078—

Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting

18RISK

open ↗

Nucleimedium

Contact Form Entries < 1.2.4 - Cross-Site Scripting

CVE-2021-25079—

Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleicritical

WordPress Popup Builder < 4.0.7 - Remote Code Execution

CVE-2021-25082—

Popup Builder < 4.0.7 - LFI to RCE

18RISK

open ↗

Nucleimedium

WOOF WordPress plugin - Cross-Site Scripting

CVE-2021-25085—

WOOF - Products Filter for WooCommerce < 1.2.6.3 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleihigh

Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution

CVE-2021-25094—

Tatsu < 3.3.12 - Unauthenticated RCE

60RISK

open ↗

Nucleimedium

WordPress GiveWP <2.17.3 - Cross-Site Scripting

CVE-2021-25099—

Give < 2.17.3 - Unauthenticated Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

WordPress Ocean Extra <1.9.5 - Cross-Site Scripting

CVE-2021-25104—

Ocean Extra < 1.9.5 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

WordPress English Admin <1.5.2 - Open Redirect

CVE-2021-25111—

English WordPress Admin < 1.5.2 - Unauthenticated Open Redirect

18RISK

open ↗

Nucleimedium

WordPress WHMCS Bridge <6.4b - Cross-Site Scripting

CVE-2021-25112—

WHMCS Bridge < 6.4b - Reflected Cross-Site Scripting (XSS)

18RISK

open ↗

Nucleicritical

WordPress Paid Memberships Pro <2.6.7 - Blind SQL Injection

CVE-2021-25114—

Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection

40RISK

open ↗

Nucleimedium

Yoast SEO 16.7-17.2 - Information Disclosure

CVE-2021-25118—

Yoast SEO 16.7-17.2 - Unauthenticated Full Path Disclosure

18RISK

open ↗

Nucleimedium

Easy Social Feed < 6.2.7 - Cross-Site Scripting

CVE-2021-25120—

Easy Social Feed < 6.2.7 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

Aruba Instant Access Point (IAP) - Cross-Site Scripting

CVE-2021-25161—

A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in ve

43RISK

open ↗

Nucleicritical

SaltStack Salt <3002.5 - Auth Bypass

CVE-2021-25281—

An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel

40RISK

open ↗

Nucleihigh

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

CVE-2021-25296HIGHunder attack

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi

100RISK

open ↗

Nucleihigh

Nagios 5.5.6-5.7.5 - Authenticated Remote Command Injection

CVE-2021-25297HIGHunder attack

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi

98RISK

open ↗

Nucleihigh

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

CVE-2021-25298HIGHunder attack

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi

100RISK

open ↗

Nucleimedium

Nagios XI 5.7.5 - Cross-Site Scripting

CVE-2021-25299—

Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/na

40RISK

open ↗

Nucleihigh

Apache Druid - Remote Code Execution

CVE-2021-25646—

Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.

60RISK

open ↗

Nucleihigh

Hue Magic 3.0.0 - Local File Inclusion

CVE-2021-25864—

node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in fil

18RISK

open ↗

Nucleihigh

Void Aural Rec Monitor 9.0.0.1 - SQL Injection

CVE-2021-25899—

An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. An unauthenticated attacker can send a craft

23RISK

open ↗

Nucleimedium

Atlassian Confluence < 5.8.6 - Server-Side Request Forgery

CVE-2021-26072—

The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers

30RISK

open ↗

Nucleicritical

Confluence Server - Remote Code Execution

CVE-2021-26084CRITICALunder attackransomware

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

100RISK

open ↗

Nucleimedium

Atlassian Confluence Server - Local File Inclusion

CVE-2021-26085MEDIUMunder attackransomware

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authoriza

100RISK

open ↗

Nucleimedium

Atlassian Jira Limited - Local File Inclusion

CVE-2021-26086MEDIUMunder attack

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path tr

100RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.