Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,337cataloged exploits

39,873CVEs with public exploitation

24,696lab-tested

All Referência 25,822Exploit-DB 24,487GitHub PoC 17,115VulnCheck XDB 9,874Nuclei 4,511Metasploit 3,528✓ verified onlyrecent popular risk

4,478 exploits

Nucleicritical

Apache APISIX Dashboard <2.10.1 - API Unauthorized Access

CVE-2021-45232—

security vulnerability on unauthorized access.

40RISK

open ↗

Nucleimedium

Gitea < 1.4.3 - Open Redirect

CVE-2021-45328—

Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs.

18RISK

open ↗

Nucleimedium

AppCMS - Cross-Site Scripting

CVE-2021-45380—

AppCMS 2.0.101 has a XSS injection vulnerability in \templates\m\inc_head.php

18RISK

open ↗

Nucleicritical

D-Link - Remote Command Execution

CVE-2021-45382CRITICALunder attack

A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L

95RISK

open ↗

Nucleicritical

Emerson Dixell XWEB-500 - Arbitrary File Write

CVE-2021-45420—

Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /

23RISK

open ↗

Nucleimedium

Reprise License Manager 14.2 - Cross-Site Scripting

CVE-2021-45422—

Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability in the /goform/activate_proce

18RISK

open ↗

Nucleicritical

Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Upload

CVE-2021-45428—

TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can uploa

50RISK

open ↗

Nucleicritical

Control Web Panel (CWP) - File Inclusion

CVE-2021-45467CRITICAL

In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to c

65RISK

open ↗

Nucleihigh

Slims9 Bulian 9.4.2 - SQL Injection

CVE-2021-45793—

Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained.

18RISK

open ↗

Nucleimedium

osTicket 1.15.x - SQL Injection

CVE-2021-45811—

A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticate

18RISK

open ↗

Nucleicritical

Pascom CPS Server-Side Request Forgery

CVE-2021-45967—

An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend To

23RISK

open ↗

Nucleihigh

Pascom CPS - Local File Inclusion

CVE-2021-45968—

An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Pho

23RISK

open ↗

Nucleimedium

Sourcecodester Car Rental Management System 1.0 - Stored Cross-Site Scripting

CVE-2021-46005—

Sourcecodester Car Rental Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via vehicalorcview parameter

18RISK

open ↗

Nucleimedium

Vehicle Service Management System - Stored Cross-Site Scripting

CVE-2021-46068—

A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the My Account Sec

18RISK

open ↗

Nucleimedium

Vehicle Service Management System 1.0 - Stored Cross Site Scripting

CVE-2021-46069—

A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Mechanic List

18RISK

open ↗

Nucleimedium

ehicle Service Management System 1.0 - Cross-Site Scripting

CVE-2021-46071—

A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Category List

18RISK

open ↗

Nucleimedium

Vehicle Service Management System 1.0 - Stored Cross Site Scripting

CVE-2021-46072—

A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service List S

18RISK

open ↗

Nucleimedium

Vehicle Service Management System 1.0 - Cross Site Scripting

CVE-2021-46073—

A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the

18RISK

open ↗

Nucleihigh

webp_server_go 0.4.0 - Path Traversal

CVE-2021-46104—

An issue was discovered in webp_server_go 0.4.0. There is a directory traversal vulnerability that can read arbitrary fi

18RISK

open ↗

Nucleihigh

Ligeo Archives Ligeo Basics - Server Side Request Forgery

CVE-2021-46107—

Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to Server Side Request Forgery (SSRF) which allows an attacke

18RISK

open ↗

Nucleihigh

AntD Admin - Sensitive Information Disclosure

CVE-2021-46371—

antd-admin 5.5.0 is affected by an incorrect access control vulnerability. Unauthorized access to some interfaces in the

18RISK

open ↗

Nucleimedium

D-Link DIR850 ET850-1.08TRb03 - Open Redirect

CVE-2021-46379—

DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrust

43RISK

open ↗

Nucleihigh

D-Link DAP-1620 - Local File Inclusion

CVE-2021-46381—

Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd]

50RISK

open ↗

Nucleimedium

Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting

CVE-2021-46387—

ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads t

43RISK

open ↗

Nucleihigh

Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion

CVE-2021-46417—

Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privilege

50RISK

open ↗

Nucleihigh

Telesquare TLR-2855KS6 - Arbitrary File Creation

CVE-2021-46418—

An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.

43RISK

open ↗

Nucleicritical

Telesquare TLR-2855KS6 - Arbitrary File Deletion

CVE-2021-46419—

An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system fil

60RISK

open ↗

Nucleicritical

SDT-CW3B1 1.1.0 - OS Command Injection

CVE-2021-46422—

Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute

60RISK

open ↗

Nucleicritical

Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Delete

CVE-2021-46424—

Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to de

50RISK

open ↗

Nucleicritical

GenieACS => 1.2.8 - OS Command Injection

CVE-2021-46704—

In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.