Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
4,513 exploits
Nucleimedium
WebTareas 2.4p5 - Cross-Site Scripting
CVE-2022-44957MEDIUM
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclien
28RISK
open ↗
Nucleimedium
WBCE CMS v1.5.4 - Cross Site Scripting (Stored)
CVE-2022-45037MEDIUM
A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbi
28RISK
open ↗
Nucleimedium
WBCE CMS v1.5.4 - Cross Site Scripting (Stored)
CVE-2022-45038MEDIUM
A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute ar
28RISK
open ↗
Nucleihigh
Linx Sphere - Directory Traversal
CVE-2022-45269HIGH
A directory traversal vulnerability in the component SCS.Web.Server.SPI/1.0 of Linx Sphere LINX 7.35.ST15 allows attacke
36RISK
open ↗
Nucleihigh
Download Monitor <= 4.7.60 - Sensitive Information Exposure
CVE-2022-45354MEDIUM
WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure
60RISK
open ↗
Nucleimedium
WordPress Paytm Payment Gateway <=2.7.0 - Server-Side Request Forgery
CVE-2022-45362HIGH
WordPress Paytm Payment Gateway Plugin <= 2.7.0 is vulnerable to Server Side Request Forgery (SSRF)
48RISK
open ↗
Nucleimedium
Stock Ticker <= 3.23.2 - Cross-Site-Scripting
CVE-2022-45365HIGH
WordPress Stock Ticker Plugin <= 3.23.2 is vulnerable to Cross Site Scripting (XSS)
48RISK
open ↗
Nucleicritical
APsystems ECU-R Firmware - Command Injection
CVE-2022-45699CRITICAL
Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attack
85RISK
open ↗
Nucleicritical
WordPress Paytm Payment Gateway <=2.7.3 - SQL Injection
CVE-2022-45805HIGH
WordPress Paytm Payment Gateway Plugin <= 2.7.3 is vulnerable to SQL Injection
36RISK
open ↗
Nucleicritical
LearnPress Plugin < 4.2.0 - Unauthenticated Time-Based Blind SQLi
CVE-2022-45808CRITICAL
WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection
63RISK
open ↗
Nucleihigh
WordPress PhonePe Payment Solutions <=1.0.15 - Server-Side Request Forgery
CVE-2022-45835MEDIUM
WordPress PhonePe Payment Solutions Plugin <= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF)
40RISK
open ↗
Nucleihigh
Mlflow <2.3.0 - Local File Inclusion
CVE-2023-2356CRITICAL
Relative Path Traversal in mlflow/mlflow
43RISK
open ↗
Nucleimedium
Joomla! Webservice - Password Disclosure
CVE-2023-23752MEDIUMunder attack
[20230201] - Core - Improper access check in webservice endpoints
100RISK
open ↗
Nucleimedium
Ozette Plugins - Cross-Site Request Forgery
CVE-2023-23897MEDIUM
WordPress Simple Mobile URL Redirect Plugin <= 1.7.2 is vulnerable to Cross Site Request Forgery (CSRF)
28RISK
open ↗
Nucleicritical
WordPress GamiPress <= 2.5.7 - SQL Injection
CVE-2023-24000HIGH
WordPress GamiPress Plugin <= 2.5.7 is vulnerable to SQL Injection
36RISK
open ↗
Nucleihigh
CData RSB Connect v22.0.8336 - Server Side Request Forgery
CVE-2023-24243HIGH
CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery (SSRF).
36RISK
open ↗
Nucleimedium
Squidex <7.4.0 - Cross-Site Scripting
CVE-2023-24278MEDIUM
Squidex before 7.4.0 was discovered to contain a squid.svg cross-site scripting (XSS) vulnerability.
28RISK
open ↗
Nucleimedium
mojoPortal 2.7.0.0 - Cross-Site Scripting
CVE-2023-24322MEDIUM
A reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows atta
40RISK
open ↗
Nucleicritical
UserPro <= 5.1.1 - Authentication Bypass
CVE-2023-2437CRITICAL
UserPro <= 5.1.1 - Authentication Bypass to Administrator
63RISK
open ↗
Nucleimedium
Citrix Gateway and Citrix ADC - Cross-Site Scripting
CVE-2023-24488MEDIUM
Cross site scripting
70RISK
open ↗
Nucleicritical
Citrix ShareFile StorageZones Controller - Unauthenticated Remote Code Execution
CVE-2023-24489CRITICALunder attack
A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, coul
100RISK
open ↗
Nucleimedium
phpIPAM - 1.6 - Cross-Site Scripting
CVE-2023-24657MEDIUM
phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter
48RISK
open ↗
Nucleimedium
PMB 7.4.6 - Cross-Site Scripting
CVE-2023-24733—
PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /ad
18RISK
open ↗
Nucleimedium
PMB 7.4.6 - Open Redirect
CVE-2023-24735—
PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php. This vulnerabil
18RISK
open ↗
Nucleimedium
PMB v7.4.6 - Cross-Site Scripting
CVE-2023-24737—
PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /ad
18RISK
open ↗
Nucleicritical
Appium Desktop Server - Remote Code Execution
CVE-2023-2479CRITICAL
OS Command Injection in appium/appium-desktop
48RISK
open ↗
Nucleicritical
vBulletin <= 5.6.9 - Pre-authentication Remote Code Execution
CVE-2023-25135CRITICAL
vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP reques
68RISK
open ↗
Nucleicritical
GeoServer OGC Filter - SQL Injection
CVE-2023-25157CRITICAL
Unfiltered SQL Injection Vulnerabilities in Geoserver
85RISK
open ↗
Nucleimedium
WordPress Easy Forms for Mailchimp Plugin < 6.8.9 - Cross-Site Scripting
CVE-2023-2518MEDIUM
Easy Forms for Mailchimp < 6.8.9 - Reflected XSS
28RISK
open ↗
Nucleihigh
Apache Druid Kafka Connect - Remote Code Execution
CVE-2023-25194HIGH
Apache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect
78RISK
open ↗
← previouspage 75 / 151next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.