Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
71,864cataloged exploits
32,153CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 19,978GitHub PoC 13,280VulnCheck XDB 8,156Nuclei 4,202Metasploit 3,462✓ verified onlyrecentpopularrisk
4,202 exploits
Nucleicritical
Ruckus Wireless Admin - Remote Code Execution
Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated
95RISK
open ↗Nucleicritical
ZoneMinder Snapshots - Command Injection
ZoneMinder vulnerable to Missing Authorization
58RISK
open ↗Nucleihigh
Lexmark Printers - Command Injection
Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).
68RISK
open ↗Nucleimedium
KiviCare WordPress Plugin - Cross-Site Scripting
KiviCare Management System < 3.2.1 - Reflected Cross-Site Scripting
18RISK
open ↗Nucleihigh
STAGIL Navigation for Jira Menu & Themes <2.0.52 - Local File Inclusion
An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2
68RISK
open ↗Nucleihigh
STAGIL Navigation for Jira Menu & Themes <2.0.52 - Local File Inclusion
An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2
61RISK
open ↗Nucleicritical
Arcserve UDP <= 9.0.6034 - Authentication Bypass
Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashSe
50RISK
open ↗Nucleihigh
Adobe Coldfusion - Authentication Bypass
CVE-2023-38205 issues | ColdFusion Admin Panel Access
41RISK
open ↗Nucleihigh
Adobe ColdFusion - Local File Read
Adobe ColdFusion Improper Access Control Arbitrary code execution
100RISK
open ↗Nucleicritical
Jorani 1.0.0 - Remote Code Execution
In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.
60RISK
open ↗Nucleicritical
Weaver E-Office 9.5 - Remote Code Execution
Weaver E-Office uploadify.php unrestricted upload
33RISK
open ↗Nucleicritical
DCBI-Netlog-LAB v1.0 - Command Injection
An issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attac
55RISK
open ↗Nucleimedium
ChurchCRM 4.5.3 - Cross-Site Scripting
A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web scr
28RISK
open ↗Nucleimedium
ChurchCRM 4.5.3 - Cross-Site Scripting
A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web scr
28RISK
open ↗Nucleimedium
ATutor < 2.2.1 - Cross Site Scripting
A Cross-site scripting (XSS) vulnerability in the function encrypt_password() in login.tmpl.php in ATutor 2.2.1 allows r
28RISK
open ↗Nucleicritical
PrestaShop AdvancedPopupCreator - SQL Injection
Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the compo
43RISK
open ↗Nucleicritical
Adobe ColdFusion - Pre-Auth Remote Code Execution
Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
95RISK
open ↗Nucleicritical
Microsoft SharePoint - Authentication Bypass
Microsoft SharePoint Server Elevation of Privilege Vulnerability
100RISK
open ↗Nucleimedium
FooGallery plugin <= 2.2.35 - Cross-Site Scripting
WordPress FooGallery Plugin <= 2.2.35 is vulnerable to Cross Site Scripting (XSS)
36RISK
open ↗Nucleimedium
OpenEMR < 7.0.1 - Cross-Site Scripting
Cross-site Scripting (XSS) - Generic in openemr/openemr
58RISK
open ↗Nucleimedium
cPanel < 11.109.9999.116 - Cross-Site Scripting
An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall
40RISK
open ↗Nucleimedium
OpenEMR < 7.0.1 - Cross-site Scripting
Cross-site Scripting (XSS) - Reflected in openemr/openemr
36RISK
open ↗Nucleimedium
XWiki >= 13.10.8 - Cross-Site Scripting
org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints
28RISK
open ↗Nucleimedium
Purchase Order Management v1.0 - Cross Site Scripting (Reflected)
Purchase Order Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the pa
28RISK
open ↗Nucleicritical
Miniorange Social Login and Register <= 7.6.3 - Authentication Bypass
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass
75RISK
open ↗Nucleicritical
Embedded JavaScript(EJS) 3.1.6 - Template Injection
ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be i
43RISK
open ↗Nucleihigh
Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion
A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitra
36RISK
open ↗Nucleicritical
SolarView Compact <= 6.00 - Local File Inclusion
SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. Any file on the server can be read or modified because t
75RISK
open ↗Nucleimedium
PowerJob V4.3.1 - Authentication Bypass
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.
28RISK
open ↗Nucleimedium
PowerJob <=4.3.2 - Unauthenticated Access
PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface.
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.