Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,337cataloged exploits
39,873CVEs with public exploitation
24,696lab-tested
AllReferência 25,822Exploit-DB 24,487GitHub PoC 17,115VulnCheck XDB 9,874Nuclei 4,511Metasploit 3,528✓ verified onlyrecentpopularrisk
4,478 exploits
Nucleimedium
FatPipe WARP/IPVPN/MPVPN - Authorization Bypass
CVE-2021-27858MEDIUM
Missing authorization vulnerability in FatPipe software
28RISK
open ↗
Nucleicritical
Apache Solr <=8.8.1 - Server-Side Request Forgery
CVE-2021-27905—
SSRF vulnerability with the Replication handler
40RISK
open ↗
Nucleimedium
Mautic <3.3.4 - Cross-Site Scripting
CVE-2021-27909MEDIUM
XSS vulnerability on password reset page
28RISK
open ↗
Nucleicritical
LumisXP <10.0.0 - Blind XML External Entity Attack
CVE-2021-27931—
LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControl
23RISK
open ↗
Nucleicritical
SonLogger - Arbitrary File Upload
CVE-2021-27964—
SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Con
50RISK
open ↗
Nucleimedium
Hongdian H8922 3.0.5 Devices - Local File Inclusion
CVE-2021-28149—
Hongdian H8922 3.0.5 devices allow Directory Traversal. The /log_download.cgi log export handler does not validate user
23RISK
open ↗
Nucleimedium
Hongdian H8922 3.0.5 - Information Disclosure
CVE-2021-28150—
Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the administrator password and oth
18RISK
open ↗
Nucleihigh
Hongdian H8922 3.0.5 - Remote Command Injection
CVE-2021-28151—
Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) f
23RISK
open ↗
Nucleimedium
Eclipse Jetty - Information Disclosure
CVE-2021-28164MEDIUM
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contai
70RISK
open ↗
Nucleimedium
Eclipse Jetty ConcatServlet - Information Disclosure
CVE-2021-28169MEDIUM
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doub
50RISK
open ↗
Nucleimedium
Joomla! ChronoForums 2.0.11 - Local File Inclusion
CVE-2021-28377—
ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files.
18RISK
open ↗
Nucleicritical
Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)
CVE-2021-28480CRITICAL
Microsoft Exchange Server Remote Code Execution Vulnerability
85RISK
open ↗
Nucleicritical
Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)
CVE-2021-28481CRITICAL
Microsoft Exchange Server Remote Code Execution Vulnerability
55RISK
open ↗
Nucleicritical
QNAP HBS 3 - Broken Access Control
CVE-2021-28799CRITICALunder attackransomware
Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)
95RISK
open ↗
Nucleicritical
Netmask NPM Package - Server-Side Request Forgery
CVE-2021-28918—
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attacke
23RISK
open ↗
Nucleihigh
Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure
CVE-2021-28937—
The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) conta
18RISK
open ↗
Nucleimedium
rConfig 3.9.6 - Local File Inclusion
CVE-2021-29006—
rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any
18RISK
open ↗
Nucleihigh
LDAP Injection In OpenAM
CVE-2021-29156—
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacke
60RISK
open ↗
Nucleicritical
Apache OFBiz < 17.12.07 - Arbitrary Code Execution
CVE-2021-29200—
RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI
30RISK
open ↗
Nucleicritical
HPE Edgeline Infrastructure Manager <1.22 - Authentication Bypass
CVE-2021-29203—
A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infr
30RISK
open ↗
Nucleicritical
Nacos <1.4.1 - Authentication Bypass
CVE-2021-29441HIGH
Authentication bypass
78RISK
open ↗
Nucleihigh
Nacos <1.4.1 - Authentication Bypass
CVE-2021-29442HIGH
Authentication bypass
68RISK
open ↗
Nucleimedium
Ghost CMS <=4.32 - Cross-Site Scripting
CVE-2021-29484MEDIUM
DOM XSS in Theme Preview
28RISK
open ↗
Nucleimedium
Jellyfin 10.7.2 - Server Side Request Forgery
CVE-2021-29490MEDIUM
Unauthenticated GET requests through Remote Image endpoints
40RISK
open ↗
Nucleihigh
XStream <1.4.17 - Remote Code Execution
CVE-2021-29505HIGH
XStream is vulnerable to a Remote Command Execution attack
58RISK
open ↗
Nucleimedium
Prometheus - Open Redirect
CVE-2021-29622MEDIUM
Arbitrary redirects under /new endpoint
33RISK
open ↗
Nucleimedium
Adminer <=4.8.0 - Cross-Site Scripting
CVE-2021-29625HIGH
XSS in doc_link
36RISK
open ↗
Nucleimedium
Seo Panel 4.8.0 - Cross-Site Scripting
CVE-2021-3002—
Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter.
18RISK
open ↗
Nucleimedium
SysAid Technologies 20.3.64 b14 - Cross-Site Scripting
CVE-2021-30049—
SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI.
18RISK
open ↗
Nucleicritical
Laminas Project laminas-http - Remote Code Execution
CVE-2021-3007—
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead
60RISK
open ↗
← previouspage 51 / 150next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.