Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
71,886cataloged exploits
32,153CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 19,978GitHub PoC 13,282VulnCheck XDB 8,176Nuclei 4,202Metasploit 3,462✓ verified onlyrecentpopularrisk
4,202 exploits
Nucleimedium
Event Monster <= 1.4.3 - Information Exposure Via Visitors List Export
Event monster <= 1.4.3 - Information Exposure Via Visitors List Export
28RISK
open ↗Nucleimedium
idcCMS V1.60 - Cross-Site Scripting
idcCMS classProvCity.php GetCityOptionJs cross site scripting
28RISK
open ↗Nucleicritical
ProjectSend <= r1605 - Improper Authorization
ProjectSend Unauthenticated Configuration Modification
100RISK
open ↗Nucleihigh
KiviCare Clinic & Patient Management System (EHR) <= 3.6.4 - SQL Injection
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection
61RISK
open ↗Nucleihigh
Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution
Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution
36RISK
open ↗Nucleimedium
LearnPress < 4.2.7.4 - Course Material - Information Disclosure
LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API
28RISK
open ↗Nucleimedium
ECT Home Page Products - Reflected XSS
ECT Home Page Products <= 1.9 - Reflected XSS
28RISK
open ↗Nucleimedium
A5 Custom Login Page - Reflected XSS
A5 Custom Login Page <= 2.8.1 - Reflected XSS
28RISK
open ↗Nucleihigh
Ads Pro Plugin <= 4.88 - Unauthenticated SQL Injection
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.88 - Unauthenticated SQL Injection
36RISK
open ↗Nucleimedium
iBuildApp <= 0.2.0 - Reflected Cross-Site Scripting
iBuildApp <= 0.2.0 - Reflected XSS
28RISK
open ↗Nucleimedium
Giga Messenger WordPress - Cross-Site Scripting
Giga Messenger Bots <= 2.3.1 - Reflected XSS
28RISK
open ↗Nucleimedium
WP Dream Carousel < 1.0.1b - Cross-Site Scripting
WP Dream Carousel <= 1.0.1b - Reflected XSS
28RISK
open ↗Nucleimedium
Guten Free Options - Cross Site Scripting
Guten Free Options <= 0.9.5 - Reflected XSS
28RISK
open ↗Nucleihigh
GamiPress <= 2.8.9 - SQL Injection
GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter
36RISK
open ↗Nucleimedium
Zarinpal Paid Download - Reflected XSS
Zarinpal Paid Downloads <= 2.3 - Reflected XSS
28RISK
open ↗Nucleihigh
WordPress Front End Users - Reflected XSS
Front End Users <= 3.2.32 - Reflected XSS
36RISK
open ↗Nucleimedium
WordPress Stray Random Quotes <= 1.9.9 - Cross-Site Scripting
Stray Random Quotes <= 1.9.9 - Reflected XSS
28RISK
open ↗Nucleimedium
WordPress 1 Click Migration Plugin < 2.3 - Information Exposure
1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.php
28RISK
open ↗Nucleimedium
LifterLMS < 8.0.1 - Cross-Site Scripting
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS
28RISK
open ↗Nucleihigh
WordPress WPMovieLibrary Plugin <= 2.1.4.8 - Cross-Site Scripting
WPMovieLibrary <= 2.1.4.8 - Reflected XSS
36RISK
open ↗Nucleihigh
Tube Video Ads Lite - Reflected XSS
Tube Video Ads Lite <= 1.5.7 - Reflected XSS
36RISK
open ↗Nucleimedium
OWL Carousel Slider - Cross-Site Scripting
WP Touch Slider <= 2.2 - Reflected XSS
28RISK
open ↗Nucleimedium
NewsTicker <= 1.0 - Reflected Cross-Site Scripting
News List <= 1.0 - Reflected XSS
28RISK
open ↗Nucleimedium
Post Sync Plugin <= 1.1 - Cross-Site Scripting
Post Sync <= 1.1 - Reflected XSS
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.