Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
4,513 exploits
Nucleicritical
Spring Cloud - Remote Code Execution
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po
100RISK
open ↗Nucleicritical
Spring - Remote Code Execution
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗Nucleicritical
VMware Workspace ONE Access/Identity Manager/vRealize Automation - Authentication Bypass
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability aff
50RISK
open ↗Nucleimedium
SINEMA Remote Connect Server < V2.0 - Open Redirect
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Affected products contain an
18RISK
open ↗Nucleicritical
Zabbix - SAML SSO Authentication Bypass
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
100RISK
open ↗Nucleimedium
Zabbix Setup Configuration Authentication Bypass
Possible view of the setup pages by unauthenticated users if config file already exists
95RISK
open ↗Nucleicritical
WordPress VR Calendar <=2.3.2 - Remote Code Execution
VR Calendar < 2.3.2 - Unauthenticated Arbitrary Function Call
23RISK
open ↗Nucleicritical
Crestron Device - Credentials Disclosure
An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI
60RISK
open ↗Nucleihigh
BigAnt Server v5.6.06 - Local File Inclusion
BigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks.
23RISK
open ↗Nucleimedium
BigAnt Server 5.6.06 - Improper Access Control
BigAnt Software BigAnt Server v5.6.06 was discovered to utilize weak password hashes.
18RISK
open ↗Nucleimedium
Cedar Gate EZ-NET <= 6.8.0 - Cross-Site Scripting
The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly
28RISK
open ↗Nucleimedium
MeterSphere < 2.5.0 SSRF
Server-Side Request Forgery in Metersphere leads to Cross-Site Scripting
36RISK
open ↗Nucleimedium
WordPress Simply Schedule Appointments <1.5.7.7 - Information Disclosure
Simply Schedule Appointments < 1.5.7.7 - Unauthenticated Email Address Disclosure
18RISK
open ↗Nucleimedium
WordPress Directorist <7.3.1 - Information Disclosure
Directorist < 7.3.1 - Unauthenticated Email Address Disclosure
18RISK
open ↗Nucleimedium
Zoho ManageEngine - Internal Hostname Disclosure
Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname
23RISK
open ↗Nucleihigh
WordPress Easy Student Results <=2.2.8 - Improper Authorization
Easy Student Results <= 2.2.8 - Sensitive Information Disclosure via REST API
18RISK
open ↗Nucleimedium
phpMyAdmin < 5.1.2 - Cross-Site Scripting
An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup
28RISK
open ↗Nucleimedium
WordPress Feed Them Social <3.0.1 - Cross-Site Scripting
Feed Them Social < 3.0.1 - Reflected Cross-Site Scripting
18RISK
open ↗Nucleihigh
AVEVA InTouch Access Anywhere Secure Gateway - Local File Inclusion
AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an
68RISK
open ↗Nucleicritical
ZZZCMS zzzphp 2.1.0 - Remote Code Execution
ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_te
30RISK
open ↗Nucleicritical
MCMS 5.2.5 - SQL Injection
MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao
18RISK
open ↗Nucleicritical
Apache ShenYu Admin Unauth Access
Apache ShenYu 2.4.1 Improper access control
40RISK
open ↗Nucleicritical
Adobe Commerce (Magento) - Remote Code Execution
Adobe Commerce checkout improper input validation leads to remote code execution
100RISK
open ↗Nucleicritical
Apache APISIX - Remote Code Execution
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
100RISK
open ↗Nucleicritical
Microfinance Management System 1.0 - SQL Injection
A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application d
23RISK
open ↗Nucleicritical
Cuppa CMS v1.0 - SQL injection
CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu_filter parameter at /administrator/te
18RISK
open ↗Nucleicritical
Cuppa CMS v1.0 - SQL injection
CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.
18RISK
open ↗Nucleicritical
Atom CMS v2.0 - SQL Injection
AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_pages.php
18RISK
open ↗Nucleicritical
Atom.CMS 2.0 - SQL Injection
Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_uploads.php
18RISK
open ↗Nucleihigh
College Management System 1.0 - SQL Injection
College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter.
43RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.