Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,886cataloged exploits
32,153CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 19,978GitHub PoC 13,282VulnCheck XDB 8,176Nuclei 4,202Metasploit 3,462✓ verified onlyrecentpopularrisk
4,202 exploits
Nucleimedium
WSO2 User Registration - Arbitrary Account Creation
CVE-2024-7097MEDIUM
Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
28RISK
open ↗
Nucleimedium
Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 - Command Injection
CVE-2024-7120MEDIUM
Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_base_config.php os command injection
70RISK
open ↗
Nucleihigh
Bylancer Quicklancer 2.4 G - SQL Injection
CVE-2024-7188MEDIUM
Bylancer Quicklancer GET Parameter listing sql injection
28RISK
open ↗
Nucleimedium
Shield Security Plugin < 20.0.6 - Cross-Site Scripting
CVE-2024-7313MEDIUM
Shield Security < 20.0.6 - Reflected XSS
28RISK
open ↗
Nucleicritical
AJ-Report < 1.4.1 - Remote Code Execution
CVE-2024-7314CRITICAL
anji-plus AJ-Report Authentication Bypass
75RISK
open ↗
Nucleicritical
TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerability
CVE-2024-7332CRITICAL
TOTOLINK CP450 Telnet Service product.ini hard-coded password
68RISK
open ↗
Nucleimedium
TVT DVR Sensitive Device - Information Disclosure
CVE-2024-7339MEDIUM
TVT DVR TD-2104TS-CL queryDevInfo information disclosure
60RISK
open ↗
Nucleihigh
W&B Weave Server - Remote Arbitrary File Leak
CVE-2024-7340HIGH
W&B Weave server remote arbitrary file leak and privilege escalation
36RISK
open ↗
Nucleimedium
Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting
CVE-2024-7354MEDIUM
Ninja Forms 3.8.6-3.8.10 - Reflected XSS
28RISK
open ↗
Nucleihigh
Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution
CVE-2024-7399HIGHunder attack
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 2
100RISK
open ↗
Nucleicritical
Kemp LoadMaster Load Balancer - Unauthenticated Command Injection
CVE-2024-7591CRITICAL
Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection
75RISK
open ↗
Nucleicritical
Ivanti vTM - Authentication Bypass
CVE-2024-7593CRITICALunder attack
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remo
100RISK
open ↗
Nucleimedium
AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls
CVE-2024-7714MEDIUM
AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls
28RISK
open ↗
Nucleihigh
Sensei LMS < 4.24.2 - Email Template Leak
CVE-2024-7786HIGH
Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak
36RISK
open ↗
Nucleicritical
Woo Inquiry <= 0.1 - SQL Injection
CVE-2024-7854CRITICAL
Woo Inquiry <= 0.1 - Unauthenticated SQL Injection
63RISK
open ↗
Nucleimedium
FastAdmin < V1.3.4.20220530 - Path Traversal
CVE-2024-7928MEDIUM
FastAdmin lang path traversal
53RISK
open ↗
Nucleicritical
Four-Faith F3x36 - Authentication Bypass
CVE-2024-9643CRITICAL
Four-Faith F3x36 Hidden Debug Credentials
43RISK
open ↗
Nucleicritical
Hunk Companion <= 1.8.4 - Arbitrary Plugin Installation
CVE-2024-9707CRITICAL
Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
63RISK
open ↗
Nucleimedium
EKC Tournament Manager WordPress plugin - Path Traversal
CVE-2024-9765MEDIUM
EKC Tournament Manager < 2.2.2 - Local File Download Vulnerability
28RISK
open ↗
Nucleihigh
WordPress UIX Shortcodes <= 1.9.7 - Unauthenticated Shortcode Execution
CVE-2024-9772HIGH
Uix Shortcodes – Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode Execution
36RISK
open ↗
Nucleicritical
WordPress WP-Advanced-Search <= 3.3.9 - SQL Injection
CVE-2024-9796MEDIUM
WP-Advanced-Search < 3.3.9.2 - Unauthenticated SQL Injection
28RISK
open ↗
Nucleihigh
HuangDou UTCMS V9 - OS Command Injection
CVE-2024-9916MEDIUM
HuangDou UTCMS cli.php os command injection
50RISK
open ↗
Nucleihigh
PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Arbitrary File Download
CVE-2024-9935HIGH
PDF Generator Addon for Elementor Page Builder <= 2.0.0 - Unauthenticated Arbitrary File Download
36RISK
open ↗
Nucleicritical
Crypto <= 2.15 - Authentication Bypass
CVE-2024-9989CRITICAL
Crypto <= 2.18 - Authentication Bypass via log_in
43RISK
open ↗
Nucleicritical
Palo Alto Networks Expedition - OS Command Injection
CVE-2025-0107HIGH
Expedition: OS Command Injection Vulnerability
58RISK
open ↗
Nucleicritical
PAN-OS Management Interface - Path Confusion to Authentication Bypass
CVE-2025-0108HIGHunder attack
PAN-OS: Authentication Bypass in the Management Web Interface
100RISK
open ↗
Nucleimedium
PAN-OS - Reflected Cross-Site Scripting
CVE-2025-0133LOW
PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and Portal
35RISK
open ↗
Nucleicritical
Ivanti Connect Secure - Stack-based Buffer Overflow
CVE-2025-0282CRITICALunder attackransomware
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7
100RISK
open ↗
Nucleicritical
Elber ESE DVB-S/S2 - Authentication Bypass
CVE-2025-0674CRITICAL
Elber Communications Equipment Authentication Bypass Using an Alternate Path or Channel
43RISK
open ↗
Nucleicritical
DocsGPT - Unauthenticated Remote Code Execution
CVE-2025-0868CRITICAL
Remote Code Execution in DocsGPT
68RISK
open ↗
← previouspage 73 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.