Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,337cataloged exploits
39,873CVEs with public exploitation
24,696lab-tested
AllReferência 25,822Exploit-DB 24,487GitHub PoC 17,115VulnCheck XDB 9,874Nuclei 4,511Metasploit 3,528✓ verified onlyrecentpopularrisk
4,511 exploits
Nucleihigh
SiYuan <= 3.6.5 - Unauthenticated Path Traversal
SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)
36RISK
open ↗Nucleihigh
SiYuan Note <= 3.6.5 - Authentication Bypass
SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist
43RISK
open ↗Nucleimedium
LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery
LobeHub: Unauthenticated SSRF in `/webapi/proxy`
43RISK
open ↗Nucleimedium
vLLM <= 0.23.0 - Anthropic Router Heap Address Information Leak
vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
28RISK
open ↗Nucleicritical
GravitLauncher LaunchServer <=5.7.11 - Unauthenticated Path Traversal to Arbitrary File Read
GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler
43RISK
open ↗Nucleicritical
YMC Filter - SQL Injection
WordPress Filter & Grids plugin <= 3.11.5 - SQL Injection vulnerability
43RISK
open ↗Nucleihigh
SeaweedFS <= 4.29 - Path Traversal File Write
SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
56RISK
open ↗Nucleimedium
Etherpad 2.1.0 <= 3.0.0 - Cross-Site Scripting
Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)
28RISK
open ↗Nucleihigh
MineAdmin < 3.2.0-alpha.2 - Plugin Path Traversal to RCE
MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall
36RISK
open ↗Nucleihigh
Gotenberg < 8.34.0 - Local File Disclosure
Gotenberg: SSRF via LibreOffice document processing
36RISK
open ↗Nucleicritical
Divi Form Builder <=5.1.8 - Unauthenticated Arbitrary File Upload RCE
Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter
63RISK
open ↗Nucleicritical
Langflow < 1.9.1 - Unauthenticated File Upload
Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak
63RISK
open ↗Nucleimedium
Yamcs <=5.8.6 - Cross-Site Scripting
Yamcs: Reflected XSS in the URL of the Authorize Endpoint
28RISK
open ↗Nucleihigh
Yamcs <=5.11.12 - Arbitrary File Read
Yamcs: Unauthenticated Directory Traversal
36RISK
open ↗Nucleimedium
Dashy <= 4.3.6 - Reflected XSS via Workspace
Dashy: XSS in workspace url parameter
23RISK
open ↗Nucleicritical
Provectus kafka-ui <=0.7.2 - Remote Code Execution
provectus kafka-ui Endpoint testexecutions validateAccess code injection
48RISK
open ↗Nucleicritical
Quotes llama <= 3.1.5 - SQL Injection
WordPress Quotes llama plugin <= 3.1.5 - SQL Injection vulnerability
43RISK
open ↗Nucleicritical
Advance Product Search <= 1.4.4 - Unauthenticated Time-Based Blind SQL Injection
WordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerability
43RISK
open ↗Nucleimedium
VvvebJs <= 2.0.5 - Cross-Site Scripting
givanz Vvvebjs File Upload Endpoint upload.php cross site scripting
48RISK
open ↗Nucleicritical
Crawl4AI < 0.8.7 - Hardcoded JWT Signing Key Authentication Bypass
Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key
43RISK
open ↗Nucleihigh
Flowise <= 3.0.13 - Unauthenticated OAuth Configuration Disclosure
Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint
36RISK
open ↗Nucleicritical
Page Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Upload
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0
100RISK
open ↗Nucleicritical
Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1
98RISK
open ↗Nucleicritical
AcyMailing < 10.11.1 - Unauthenticated SQL Injection
Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1
63RISK
open ↗Nucleihigh
9router <=0.5.4 - Authentication Bypass
9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header
36RISK
open ↗Nucleicritical
Gorse < 0.5.10 - Unauthenticated Database Dump
Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints
63RISK
open ↗Nucleicritical
Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass
56RISK
open ↗Nucleihigh
RabbitMQ Management - OAuth 2 Client Secret Disclosure
RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations
36RISK
open ↗Nucleicritical
RSFiles! for Joomla - Arbitrary File Upload
Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12
63RISK
open ↗Nucleicritical
Hermes WebUI < 0.51.788 - Remote Code Execution
Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API
43RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.