Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
4,513 exploits
Nucleihigh
WordPress Ninja Job Board < 1.3.3 - Direct Request
Ninja Job Board < 1.3.3 - Resume Disclosure via Directory Listing
18RISK
open ↗Nucleimedium
WordPress All-in-One WP Migration <=7.62 - Cross-Site Scripting
All-in-One WP Migration < 7.63 - Unauthenticated Reflected XSS
28RISK
open ↗Nucleihigh
ThinkPHP 5.0.24 - Information Disclosure
ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to acce
28RISK
open ↗Nucleihigh
Cuppa CMS v1.0 - Local File Inclusion
CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php.
18RISK
open ↗Nucleihigh
Cuppa CMS v1.0 - Local File Inclusion
CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php.
18RISK
open ↗Nucleicritical
Atom CMS v2.0 - Remote Code Execution
Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php.
30RISK
open ↗Nucleicritical
Atom CMS v2.0 - SQL Injection
Atom CMS v2.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/ajax/avatar.php.
18RISK
open ↗Nucleimedium
Atom CMS v2.0 - Cross-Site Scripting
Atom CMS v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "A" parameter in /w
18RISK
open ↗Nucleimedium
Cuppa CMS v1.0 - Local File Inclusion
CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function.
18RISK
open ↗Nucleihigh
WordPress Duplicator <1.4.7 - Authentication Bypass
Duplicator < 1.4.7 - Unauthenticated Backup Download
43RISK
open ↗Nucleimedium
Duplicator < 1.4.7.1 - Information Disclosure
Duplicator < 1.4.7.1 - Unauthenticated System Information Disclosure
43RISK
open ↗Nucleihigh
MotionEye Config Info Disclosure
MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To explo
18RISK
open ↗Nucleimedium
WordPress Anti-Malware Security and Brute-Force Firewall <4.21.83 - Cross-Site Scripting
Anti-Malware Security and Brute-Force Firewall < 4.21.83 - Reflected Cross-Site Scripting
18RISK
open ↗Nucleicritical
Confluence - Remote Code Execution
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
100RISK
open ↗Nucleicritical
Atlassian Questions For Confluence - Hardcoded Credentials
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in th
100RISK
open ↗Nucleicritical
Mitel MiCollab - Information Disclosure & Denial of Service
The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows
95RISK
open ↗Nucleicritical
Grafana & Zabbix Integration - Credentials Disclosure
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the a
30RISK
open ↗Nucleimedium
Ametys CMS Information Disclosure
The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as
23RISK
open ↗Nucleihigh
Barco Control Room Management Suite <=2.9 Build 0275 - Local File Inclusion
Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allow
23RISK
open ↗Nucleimedium
Yonyou U8 13.0 - Cross-Site Scripting
Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/W
30RISK
open ↗Nucleimedium
WordPress Newspaper < 12 - Cross-Site Scripting
Newspaper < 12 - Reflected Cross-Site Scripting
28RISK
open ↗Nucleihigh
74cmsSE v3.4.1 - Arbitrary File Read
74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controlle
18RISK
open ↗Nucleihigh
All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side reques
48RISK
open ↗Nucleicritical
DotCMS - Arbitrary File Upload
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form req
100RISK
open ↗Nucleimedium
HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting
HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability via the prezzoperiodo4 p
18RISK
open ↗Nucleicritical
Mingsoft MCMS v5.2.7 - SQL Injection
Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.
18RISK
open ↗Nucleicritical
Open Automation Software OAS Platform V16.00.0121 - Missing Authentication
An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V
55RISK
open ↗Nucleicritical
elFinder <=2.1.60 - Local File Inclusion
connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote
30RISK
open ↗Nucleihigh
Yearning - Directory Traversal
Yearning versions 2.3.1 and 2.3.2 Interstellar GA and 2.3.4 - 2.3.6 Neptune is vulnerable to Directory Traversal.
18RISK
open ↗Nucleicritical
Bitrix Site Manager - Remote Code Execution
In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can ex
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.