Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,886cataloged exploits

32,153CVEs with public exploitation

1,932lab-tested

All Exploit-DB 22,786Referência 19,978GitHub PoC 13,282VulnCheck XDB 8,176Nuclei 4,202Metasploit 3,462✓ verified onlyrecent popular risk

4,202 exploits

Nucleicritical

Limit Login Attempts (Spam Protection) < 5.1 - SQL Injection

CVE-2022-0787—

Limit Login Attempts (Spam Protection) < 5.1 - Unauthenticated SQLi

18RISK

open ↗

Nucleicritical

WordPress WP Fundraising Donation and Crowdfunding Platform <1.5.0 - SQL Injection

CVE-2022-0788—

WP Fundraising Donation and Crowdfunding Platform < 1.5.0 - Unauthenticated SQLi

18RISK

open ↗

Nucleicritical

Ubigeo de Peru < 3.6.4 - SQL Injection

CVE-2022-0814—

Ubigeo de Peru < 3.6.4 - Unauthenticated SQLi

18RISK

open ↗

Nucleicritical

WordPress BadgeOS <=3.7.0 - SQL Injection

CVE-2022-0817—

BadgeOS <= 3.7.0 - Unauthenticated SQLi

23RISK

open ↗

Nucleihigh

Webmin <1.990 - Improper Access Control

CVE-2022-0824HIGH

Improper Access Control to Remote Code Execution in webmin/webmin

78RISK

open ↗

Nucleicritical

WordPress WP Video Gallery <=1.7.1 - SQL Injection

CVE-2022-0826—

WP Video Gallery <= 1.7.1 - Unauthenticated SQLi

18RISK

open ↗

Nucleicritical

WordPress Best Books <=2.6.3 - SQL Injection

CVE-2022-0827—

Bestbooks <= 2.6.3 - Unauthenticated SQLi

18RISK

open ↗

Nucleicritical

SpeakOut Email Petitions < 2.14.15.1 - SQL Injection

CVE-2022-0846—

SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQLi

18RISK

open ↗

Nucleimedium

UpdraftPlus < 1.22.9 - Cross-Site Scripting

CVE-2022-0864—

UpdraftPlus < 1.22.9 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleicritical

WordPress ARPrice <3.6.1 - SQL Injection

CVE-2022-0867—

ARPrice Lite < 3.6.1 - Unauthenticated SQLi

23RISK

open ↗

Nucleimedium

nitely/spirit 0.12.3 - Open Redirect

CVE-2022-0869MEDIUM

Multiple Open Redirect in nitely/spirit

28RISK

open ↗

Nucleimedium

Gogs <0.12.5 - Server-Side Request Forgery

CVE-2022-0870MEDIUM

Server-Side Request Forgery (SSRF) in gogs/gogs

28RISK

open ↗

Nucleimedium

WordPress Gmedia Photo Gallery Plugin < 1.20.0 - Cross-Site Scripting

CVE-2022-0873—

Gmedia Photo Gallery < 1.20.0 - Admin+ Stored Cross-Site Scripting

18RISK

open ↗

Nucleimedium

Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting

CVE-2022-0879—

Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleicritical

Member Hero <=1.0.9 - Remote Code Execution

CVE-2022-0885—

Member Hero <= 1.0.9 - Unauthenticated RCE

18RISK

open ↗

Nucleimedium

Header Footer Code Manager < 1.1.24 - Cross-Site Scripting

CVE-2022-0899—

Header Footer Code Manager < 1.1.24 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

Microweber < 1.2.12 - Stored Cross-Site Scripting

CVE-2022-0928MEDIUM

Cross-site Scripting (XSS) - Stored in microweber/microweber

28RISK

open ↗

Nucleicritical

WordPress Order Listener for WooCommerce <3.2.2 - SQL Injection

CVE-2022-0948—

Order Listener for WooCommerce < 3.2.2 - Unauthenticated SQLi

18RISK

open ↗

Nucleicritical

WordPress Stop Bad Bots <6.930 - SQL Injection

CVE-2022-0949—

WP Block and Stop Bad Bots < 6.930 - Unauthenticated SQLi

18RISK

open ↗

Nucleihigh

WordPress Sitemap by click5 <1.0.36 - Missing Authorization

CVE-2022-0952—

Sitemap by click5 < 1.0.36 - Unauthenticated Arbitrary Options Update

43RISK

open ↗

Nucleimedium

Microweber <1.2.11 - Stored Cross-Site Scripting

CVE-2022-0954MEDIUM

Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in microweber/microweber

28RISK

open ↗

Nucleimedium

Microweber <1.2.12 - Stored Cross-Site Scripting

CVE-2022-0963MEDIUM

Unrestricted XML Files Leads to Stored XSS in microweber/microweber

28RISK

open ↗

Nucleimedium

Microweber <1.2.12 - Integer Overflow

CVE-2022-0968HIGH

The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in microweber/microweber

36RISK

open ↗

Nucleimedium

WordPress Advanced Booking Calendar <1.7.1 - Cross-Site Scripting

CVE-2022-1007—

Advanced Booking Calendar < 1.7.1 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleicritical

WordPress Personal Dictionary <1.3.4 - Blind SQL Injection

CVE-2022-1013—

Personal Dictionary < 1.3.4 - Unauthenticated SQLi

18RISK

open ↗

Nucleicritical

WordPress WooCommerce <3.1.2 - Arbitrary Function Call

CVE-2022-1020—

Woo Product Table < 3.1.2 - Unauthenticated Arbitrary Function Call

23RISK

open ↗

Nucleihigh

Kyocera Net View Address Book Exposure

CVE-2022-1026HIGH

Kyocera Net View Address Book Exposure

61RISK

open ↗

Nucleimedium

Limit Login Attempts - Stored Cross-Site Scripting

CVE-2022-1029—

Limit Login Attempts < 4.0.72 - Admin+ Stored Cross-Site Scripting

18RISK

open ↗

Nucleicritical

Sophos Firewall <=18.5 MR3 - Remote Code Execution

CVE-2022-1040CRITICALunder attack

An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sopho

100RISK

open ↗

Nucleimedium

WordPress RSVP and Event Management <2.7.8 - Missing Authorization

CVE-2022-1054—

RSVP and Event Management < 2.7.8 - Unauthenticated Entries Export

18RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.