Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,337cataloged exploits

39,873CVEs with public exploitation

24,696lab-tested

All Referência 25,822Exploit-DB 24,487GitHub PoC 17,115VulnCheck XDB 9,874Nuclei 4,511Metasploit 3,528✓ verified onlyrecent popular risk

4,478 exploits

Nucleimedium

WordPress White Label CMS <2.2.9 - Cross-Site Scripting

CVE-2022-0422—

White Label MS < 2.2.9 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

Popup by Supsystic < 1.10.9 - Subscriber Email Addresses Disclosure

CVE-2022-0424—

Popup by Supsystic < 1.10.9 - Unauthenticated Subscriber Email Addresses Disclosure

18RISK

open ↗

Nucleimedium

WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Cross-Site Scripting

CVE-2022-0429—

WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Unauthenticated Stored Cross-Site Scripting

18RISK

open ↗

Nucleimedium

Mastodon Prototype Pollution Vulnerability

CVE-2022-0432HIGH

Prototype Pollution in mastodon/mastodon

36RISK

open ↗

Nucleicritical

WordPress Page Views Count <2.4.15 - SQL Injection

CVE-2022-0434—

Page Views Count < 2.4.15 - Unauthenticated SQL Injection

23RISK

open ↗

Nucleimedium

karma-runner DOM-based Cross-Site Scripting

CVE-2022-0437MEDIUM

Cross-site Scripting (XSS) - DOM in karma-runner/karma

33RISK

open ↗

Nucleihigh

Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection

CVE-2022-0439—

Email Subscribers & Newsletters < 5.3.2 - Subscriber+ Blind SQL injection

18RISK

open ↗

Nucleicritical

MasterStudy LMS <2.7.6 - Improper Access Control

CVE-2022-0441—

MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation

60RISK

open ↗

Nucleicritical

Popup Builder Plugin - SQL Injection and Cross-Site Scripting

CVE-2022-0479—

Popup Builder < 4.1.1 - SQL Injection to Reflected Cross-Site Scripting

30RISK

open ↗

Nucleicritical

Easy!Appointments <1.4.3 - Broken Access Control

CVE-2022-0482CRITICAL

Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments

75RISK

open ↗

Nucleimedium

Ditty (formerly Ditty News Ticker) < 3.0.15 - Cross-Site Scripting

CVE-2022-0533—

Ditty (formerly Ditty News Ticker) < 3.0.15 - Reflected Cross-Site Scripting (XSS)

18RISK

open ↗

Nucleimedium

WordPress E2Pdf <1.16.45 - Cross-Site Scripting

CVE-2022-0535—

E2Pdf < 1.16.45 - Admin+ Stored Cross-Site Scripting (XSS)

18RISK

open ↗

Nucleicritical

Atlassian Jira Seraph - Authentication Bypass

CVE-2022-0540CRITICAL

A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially

85RISK

open ↗

Nucleicritical

Formcraft3 <3.8.28 - Server-Side Request Forgery

CVE-2022-0591—

Formcraft3 < 3.8.28 - Unauthenticated SSRF

43RISK

open ↗

Nucleicritical

MapSVG < 6.2.20 - Unauthenticated SQLi

CVE-2022-0592—

MapSVG < 6.2.20 - Unauthenticated SQLi

23RISK

open ↗

Nucleimedium

WordPress Shareaholic <9.7.6 - Information Disclosure

CVE-2022-0594—

Shareaholic < 9.7.6 - Information Disclosure

18RISK

open ↗

Nucleimedium

WordPress Contact Form 7 <1.3.6.3 - Stored Cross-Site Scripting

CVE-2022-0595—

Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS

23RISK

open ↗

Nucleimedium

Microweber < 1.2.11 - Open Redirection

CVE-2022-0597MEDIUM

Open Redirect in microweber/microweber

28RISK

open ↗

Nucleimedium

WordPress Mapping Multiple URLs Redirect Same Page <=5.8 - Cross-Site Scripting

CVE-2022-0599—

Mapping Multiple URLs Redirect Same Page <= 5.8 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleihigh

WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection

CVE-2022-0651CRITICAL

WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type

55RISK

open ↗

Nucleimedium

Wordpress Profile Builder Plugin Cross-Site Scripting

CVE-2022-0653MEDIUM

Profile Builder – User Profile & User Registration Forms <= 3.6.1 Reflected Cross-Site Scripting

28RISK

open ↗

Nucleihigh

uDraw <3.3.3 - Local File Inclusion

CVE-2022-0656—

uDraw < 3.3.3 - Unauthenticated Arbitrary File Access

18RISK

open ↗

Nucleicritical

CommonsBooking < 2.6.8 - SQL Injection

CVE-2022-0658—

CommonsBooking < 2.6.8 - Unauthenticated SQL Injection

18RISK

open ↗

Nucleihigh

Microweber <1.2.11 - Information Disclosure

CVE-2022-0660CRITICAL

Generation of Error Message Containing Sensitive Information in microweber/microweber

43RISK

open ↗

Nucleihigh

Microweber < 1.2.11 - CRLF Injection

CVE-2022-0666HIGH

CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in microweber/microweber

48RISK

open ↗

Nucleimedium

Microweber <1.2.11 - Cross-Site Scripting

CVE-2022-0678MEDIUM

Cross-site Scripting (XSS) - Reflected in microweber/microweber

28RISK

open ↗

Nucleicritical

WordPress Narnoo Distributor <=2.5.1 - Local File Inclusion

CVE-2022-0679—

Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCE

30RISK

open ↗

Nucleimedium

Rudloff alltube prior to 3.0.1 - Open Redirect

CVE-2022-0692MEDIUM

Open Redirect on Rudloff/alltube in rudloff/alltube

28RISK

open ↗

Nucleicritical

WordPress Master Elements <=8.0 - SQL Injection

CVE-2022-0693—

Master Elements <= 8.0 - Unauthenticated SQLi

18RISK

open ↗

Nucleicritical

GitLab CE/EE - Information Disclosure

CVE-2022-0735CRITICAL

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star

48RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.