Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,337cataloged exploits

39,873CVEs with public exploitation

24,696lab-tested

All Referência 25,822Exploit-DB 24,487GitHub PoC 17,115VulnCheck XDB 9,874Nuclei 4,511Metasploit 3,528✓ verified onlyrecent popular risk

4,478 exploits

Nucleicritical

Kaseya VSA < 9.5.7 - Credential Disclosure via Windows Agent

CVE-2021-30116CRITICALunder attackransomware

Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6

95RISK

open ↗

Nucleicritical

Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Execution

CVE-2021-30118CRITICAL

Unauthenticated Remote Code Execution in Kaseya VSA < v9.5.5

55RISK

open ↗

Nucleicritical

Apache OFBiz <17.12.07 - Arbitrary Code Execution

CVE-2021-30128—

Unsafe deserialization in Apache OFBiz

60RISK

open ↗

Nucleimedium

Php-mod/curl Library <2.3.2 - Cross-Site Scripting

CVE-2021-30134MEDIUM

php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key paramet

28RISK

open ↗

Nucleimedium

Sidekiq <=6.2.0 - Cross-Site Scripting

CVE-2021-30151—

Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explore

18RISK

open ↗

Nucleihigh

Intelbras WIN 300/WRN 342 - Credentials Disclosure

CVE-2021-3017—

The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover creden

30RISK

open ↗

Nucleicritical

ZEROF Web Server 1.0 - SQL Injection

CVE-2021-30175—

ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page.

18RISK

open ↗

Nucleicritical

IPeakCMS 3.5 - SQL Injection

CVE-2021-3018—

ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the

43RISK

open ↗

Nucleihigh

ffay lanproxy Directory Traversal

CVE-2021-3019—

ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection t

23RISK

open ↗

Nucleihigh

Dzzoffice 2.02.1 - Cross-Site Scripting

CVE-2021-30203—

A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers

18RISK

open ↗

Nucleimedium

Knowage Suite 7.3 - Cross-Site Scripting

CVE-2021-30213—

Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). An attacker can inject arbitrar

18RISK

open ↗

Nucleicritical

VoipMonitor <24.61 - Remote Code Execution

CVE-2021-30461—

A remote code execution issue was discovered in the web UI of VoIPmonitor before 24.61. When the recheck option is used,

50RISK

open ↗

Nucleihigh

Ivanti Avalanche 6.3.2 - Local File Inclusion

CVE-2021-30497—

Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal

40RISK

open ↗

Nucleicritical

PrestaShop 1.7.7.0 - SQL Injection

CVE-2021-3110—

The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller

23RISK

open ↗

Nucleimedium

Microsoft Exchange Server - Cross-Site Scripting

CVE-2021-31195MEDIUM

Microsoft Exchange Server Remote Code Execution Vulnerability

50RISK

open ↗

Nucleimedium

CHIYU TCP/IP Converter - Carriage Return Line Feed Injection

CVE-2021-31249—

A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology I

23RISK

open ↗

Nucleimedium

CHIYU TCP/IP Converter - Cross-Site Scripting

CVE-2021-31250—

Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU T

40RISK

open ↗

Nucleicritical

Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution

CVE-2021-3129CRITICALunder attackransomware

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra

100RISK

open ↗

Nucleicritical

CentOS Web Panel - SQL Injection

CVE-2021-31316—

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST param

23RISK

open ↗

Nucleicritical

CentOS Web Panel - OS Command Injection

CVE-2021-31324—

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root R

30RISK

open ↗

Nucleihigh

Home Assistant HACS - Local File Inclusion

CVE-2021-3152—

Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks aga

18RISK

open ↗

Nucleimedium

SIS Informatik REWE GO SP17 <7.7 - Cross-Site Scripting

CVE-2021-31537—

SIS SIS-REWE Go before 7.7 SP17 allows XSS: rewe/prod/web/index.php (affected parameters are config, version, win, db, p

18RISK

open ↗

Nucleimedium

Akkadian Provisioning Manager - Information Disclosure

CVE-2021-31581HIGH

Akkadian Provisioning Manager Engine (PME) Shell Escape via 'vi' editor interface

36RISK

open ↗

Nucleimedium

BeyondTrust Secure Remote Access Base <=6.0.1 - Cross-Site Scripting

CVE-2021-31589—

A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Sof

43RISK

open ↗

Nucleihigh

Hitachi Vantara Pentaho/Business Intelligence Server - Authentication Bypass

CVE-2021-31602MEDIUM

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. The

60RISK

open ↗

Nucleimedium

WebCTRL OEM <= 6.5 - Cross-Site Scripting

CVE-2021-31682—

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for re

43RISK

open ↗

Nucleicritical

Tenda Router AC11 - Remote Command Injection

CVE-2021-31755CRITICALunder attack

An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerabili

95RISK

open ↗

Nucleicritical

Apache Struts2 S2-062 - Remote Code Execution

CVE-2021-31805—

Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.

60RISK

open ↗

Nucleicritical

Layer5 Meshery 0.5.2 - SQL Injection

CVE-2021-31856—

A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL comman

40RISK

open ↗

Nucleimedium

SysAid 20.4.74 - Cross-Site Scripting

CVE-2021-31862—

SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication.

18RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.