Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,886cataloged exploits
32,153CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 19,978GitHub PoC 13,282VulnCheck XDB 8,176Nuclei 4,202Metasploit 3,462✓ verified onlyrecentpopularrisk
4,202 exploits
Nucleimedium
XWiki WYSIWYG API - Open Redirect
CVE-2025-32970MEDIUM
org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability
28RISK
open ↗
Nucleihigh
Karel IP Phone IP1211 Web Management Panel - Local File Inclusion
CVE-2025-34023HIGH
Karel IP Phone IP1211 Path Traversal
36RISK
open ↗
Nucleicritical
Versa Concerto Actuator Endpoint - Authentication Bypass
CVE-2025-34026CRITICALunder attack
Versa Concerto Actuator Authentication Bypass Information Leak
100RISK
open ↗
Nucleicritical
Versa Concerto API Path Based - Authentication Bypass
CVE-2025-34027CRITICAL
Versa Concerto Authentication Bypass File Write Remote Code Execution
75RISK
open ↗
Nucleicritical
Commvault - SSRF via /commandcenter/deployWebpackage.do
CVE-2025-34028CRITICALunder attack
Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
100RISK
open ↗
Nucleicritical
sar2html <=3.2.2 Plot Parameter - Remote Code Execution
CVE-2025-34030CRITICAL
sar2html OS Command Injection
75RISK
open ↗
Nucleihigh
Moodle Jmol Filter 6.1 - Local File Inclusion
CVE-2025-34031HIGH
Moodle LMS Jmol Plugin Path Traversal
36RISK
open ↗
Nucleimedium
Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting
CVE-2025-34032MEDIUM
Moodle LMS Jmol Plugin Cross-site Scripting (XSS)
28RISK
open ↗
Nucleicritical
EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution
CVE-2025-34035CRITICAL
EnGenius EnShare IoT Gigabit Cloud Service Command Injection
68RISK
open ↗
Nucleihigh
Fanwei e-cology - SQL Injection
CVE-2025-34038HIGH
Weaver E-cology SQL Injection
36RISK
open ↗
Nucleicritical
Zhiyuan OA Platform - Arbitrary File Upload
CVE-2025-34040CRITICAL
Seeyon Zhiyuan OA System Path Traversal File Upload
68RISK
open ↗
Nucleihigh
WeiPHP 5.0 - Path Traversal
CVE-2025-34045HIGH
WeiPHP Path Traversal Arbitrary File Read
36RISK
open ↗
Nucleicritical
Maltrail <=0.54 Username Parameter - Remote Command Execution
CVE-2025-34073CRITICAL
stamparm/maltrail <=0.54 Remote Command Execution
63RISK
open ↗
Nucleicritical
WordPress Pie Register <= 3.7.1.4 - Authentication Bypass
CVE-2025-34077CRITICAL
WordPress Pie Register Plugin ≤ 3.7.1.4 Authentication Bypass RCE
63RISK
open ↗
Nucleicritical
WordPress Simple File List <=4.2.2 - Remote Code Execution
CVE-2025-34085—
35RISK
open ↗
Nucleimedium
ETQ Reliance - Reflected XSS via SQLConverterServlet
CVE-2025-34141MEDIUM
ETQ Reliance CG < SE.2025.1 Reflected XSS in `SQLConverterServlet`
28RISK
open ↗
Nucleicritical
ETQ Reliance - Authentication Bypass via Trailing Space
CVE-2025-34143CRITICAL
ETQ Reliance CG Authentication Bypass via Trailing Space RCE
48RISK
open ↗
Nucleimedium
Grafana - Exposes DingDing API Keys
CVE-2025-3415MEDIUM
Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not p
28RISK
open ↗
Nucleicritical
Shenzhen Aitemi M300 Wi-Fi Repeater – Unauthenticated Remote Command Execution via `time` Parameter
CVE-2025-34152CRITICAL
Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via Time Parameter
75RISK
open ↗
Nucleicritical
Langflow AI <= 1.6.9 - CORS Misconfiguration
CVE-2025-34291CRITICALunder attack
Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE
100RISK
open ↗
Nucleicritical
Samsung MagicINFO 9 Server - File Upload & Remote Code Execution
CVE-2025-4632CRITICALunder attack
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 2
98RISK
open ↗
Nucleihigh
YesWiki Reflected XSS via File Upload
CVE-2025-46349HIGH
YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
36RISK
open ↗
Nucleimedium
Broadstreet WordPress plugin - Reflected XSS
CVE-2025-4652MEDIUM
Broadstreet < 1.51.8 - Reflected XSS
28RISK
open ↗
Nucleimedium
YesWiki <= 4.5.1 - Cross-Site Scripting
CVE-2025-46549MEDIUM
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
28RISK
open ↗
Nucleimedium
YesWiki < 4.5.4 - Cross-Site Scripting
CVE-2025-46550MEDIUM
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
28RISK
open ↗
Nucleihigh
XWiki REST API - Attachments Disclosure
CVE-2025-46554MEDIUM
XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API
28RISK
open ↗
Nucleimedium
Vite Dev Server - Information Exposure
CVE-2025-46565MEDIUM
Vite's server.fs.deny bypassed with /. for files under project root
28RISK
open ↗
Nucleihigh
Java-springboot-codebase 1.1 - Arbitrary File Read
CVE-2025-46822HIGH
Unauthenticated Arbitrary File Read via Absolute Path
56RISK
open ↗
Nucleicritical
Mitel 6000 - OS Command Injection
CVE-2025-47188MEDIUM
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and th
40RISK
open ↗
Nucleimedium
Bootstrap Multiselect <= 1.1.2 - Cross-Site Scripting
CVE-2025-47204MEDIUM
An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the sour
28RISK
open ↗
← previouspage 78 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.