Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,566cataloged exploits

39,907CVEs with public exploitation

24,696lab-tested

All Referência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecent popular risk

4,513 exploits

Nucleimedium

Limit Login Attempts WordPress - Stored Cross-site Scripting

CVE-2021-24657—

Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site Scripting

18RISK

open ↗

Nucleicritical

WordPress Podlove Podcast Publisher <3.5.6 - SQL Injection

CVE-2021-24666—

Podlove Podcast Publisher < 3.5.6 - Unauthenticated SQL Injection

18RISK

open ↗

Nucleimedium

Duplicate Page WordPress - Stored Cross-Site Scripting

CVE-2021-24681—

Duplicate Page <= 4.4.2 - Admin+ Stored Cross-Site Scripting

18RISK

open ↗

Nucleicritical

Pie Register < 3.7.1.6 - SQL Injection

CVE-2021-24731—

Pie Register < 3.7.1.6 - Unauthenticated SQL Injection

18RISK

open ↗

Nucleimedium

WordPress Sassy Social Share Plugin <3.3.40 - Cross-Site Scripting

CVE-2021-24746—

Sassy Social Share < 3.3.40 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleihigh

WordPress Visitor Statistics (Real Time Traffic) <4.8 -SQL Injection

CVE-2021-24750—

WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection

50RISK

open ↗

Nucleicritical

WordPress Perfect Survey <1.5.2 - SQL Injection

CVE-2021-24762—

Perfect Survey < 1.5.2 - Unauthenticated SQL Injection

60RISK

open ↗

Nucleihigh

Download Monitor < 4.4.5 - SQL Injection

CVE-2021-24786HIGH

Download Monitor < 4.4.5 - Admin+ SQL Injection

61RISK

open ↗

Nucleihigh

Header Footer Code Manager < 1.1.14 - Admin+ SQL Injection

CVE-2021-24791—

Header Footer Code Manager < 1.1.14 - Admin+ SQL Injections

18RISK

open ↗

Nucleicritical

WordPress Asgaros Forum <1.15.13 - SQL Injection

CVE-2021-24827—

Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection

23RISK

open ↗

Nucleimedium

WordPress AnyComment <0.3.5 - Open Redirect

CVE-2021-24838—

AnyComment < 0.3.5 - Open Redirect

18RISK

open ↗

Nucleicritical

WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection

CVE-2021-24849—

WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection

18RISK

open ↗

Nucleihigh

WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection

CVE-2021-24862—

RegistrationMagic < 5.0.1.6 - Admin+ SQL Injection

60RISK

open ↗

Nucleimedium

WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting

CVE-2021-24875—

eCommerce Product Catalog for WordPress < 3.0.39 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

Registrations for The Events Calendar < 2.7.5 - Authenticated Reflected Cross-Site Scripting

CVE-2021-24876—

Registrations for The Events Calendar < 2.7.5 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

CVE-2021-24878—

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

WordPress Elementor Website Builder <3.1.4 - Cross-Site Scripting

CVE-2021-24891—

Elementor < 3.4.8 - DOM Cross-Site-Scripting

23RISK

open ↗

Nucleimedium

WordPress Transposh Translation <1.0.8 - Cross-Site Scripting

CVE-2021-24910—

Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleicritical

Contest Gallery < 13.1.0.6 - SQL injection

CVE-2021-24915—

Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure

23RISK

open ↗

Nucleihigh

WordPress Qubely < 1.8.6 - Unauthenticated Email Sending

CVE-2021-24916—

Qubely < 1.8.6 - Unauthenticated Arbitrary E-mail Sending

18RISK

open ↗

Nucleihigh

WordPress WPS Hide Login <1.9.1 - Information Disclosure

CVE-2021-24917—

WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header

40RISK

open ↗

Nucleimedium

WordPress Domain Check <1.0.17 - Cross-Site Scripting

CVE-2021-24926—

Domain Check < 1.0.17 - Reflected Cross-Site Scripting

43RISK

open ↗

Nucleicritical

WordPress Secure Copy Content Protection and Content Locking <2.8.2 - SQL Injection

CVE-2021-24931—

Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL Injection

60RISK

open ↗

Nucleimedium

Visual CSS Style Editor < 7.5.4 - Cross-Site Scripting

CVE-2021-24934—

Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

WordPress Persian Woocommerce <=5.8.0 - Cross-Site Scripting

CVE-2021-24940—

Persian Woocommerce <= 5.8.0 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleicritical

Registrations for the Events Calendar < 2.7.6 - SQL Injection

CVE-2021-24943—

Registrations for the Events Calendar < 2.7.6 - Unauthenticated SQL Injection

18RISK

open ↗

Nucleicritical

WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection

CVE-2021-24946—

Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection

60RISK

open ↗

Nucleimedium

WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read

CVE-2021-24947—

RVM - Responsive Vector Maps < 6.4.2 - Subscriber+ Arbitrary File Read

18RISK

open ↗

Nucleimedium

Blog2Social < 6.8.7 - Cross-Site Scripting

CVE-2021-24956—

Blog2Social < 6.8.7 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleihigh

WordPress All-In-One Video Gallery <2.5.0 - Local File Inclusion

CVE-2021-24970—

All-In-One-Gallery < 2.5.0 - Admin+ Local File Inclusion

18RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.