Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,566cataloged exploits

39,907CVEs with public exploitation

24,696lab-tested

All Referência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecent popular risk

4,513 exploits

Nucleihigh

College Management System 1.0 - SQL Injection

CVE-2022-28079—

College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter.

43RISK

open ↗

Nucleihigh

Royal Event - SQL Injection

CVE-2022-28080—

Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.

50RISK

open ↗

Nucleicritical

Selenium Grid < 4.0.0-alpha-7 - Remote Code Execution

CVE-2022-28108—

Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-url

23RISK

open ↗

Nucleimedium

Navigate CMS 2.9.4 - Server-Side Request Forgery

CVE-2022-28117—

A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the ap

43RISK

open ↗

Nucleicritical

Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution

CVE-2022-28219—

Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote

60RISK

open ↗

Nucleimedium

WordPress Country Selector <1.6.6 - Cross-Site Scripting

CVE-2022-28290—

Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload execut

18RISK

open ↗

Nucleimedium

Reprise License Manager 14.2 - Cross-Site Scripting

CVE-2022-28363—

Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_pr

18RISK

open ↗

Nucleimedium

Reprise License Manager 14.2 - Information Disclosure

CVE-2022-28365—

Reprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminf

18RISK

open ↗

Nucleimedium

MantisBT < 2.25.2 - Cross-Site Scripting

CVE-2022-28508—

An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2. Unescaped output of the return param

18RISK

open ↗

Nucleimedium

WordPress WPvivid Backup <0.9.76 - Local File Inclusion

CVE-2022-2863—

WPvivid Backup < 0.9.76 - Admin+ Arbitrary File Read

23RISK

open ↗

Nucleimedium

Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update

CVE-2022-28666MEDIUM

WordPress Custom Product Tabs for WooCommerce plugin <= 1.7.7 - Broken Access Control vulnerability

28RISK

open ↗

Nucleimedium

Caddy 2.4.6 - Open Redirect

CVE-2022-28923MEDIUM

Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phi

28RISK

open ↗

Nucleihigh

D-Link DIR-816L - Improper Access Control

CVE-2022-28955—

An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php an

30RISK

open ↗

Nucleimedium

Zoho ManageEngine ADSelfService Plus 6121 - Username Enumeration

CVE-2022-28987—

Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST req

23RISK

open ↗

Nucleimedium

Diary Management System 1.0 - Cross-Site Scripting

CVE-2022-29004—

Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter

18RISK

open ↗

Nucleimedium

Online Birth Certificate System 1.2 - Stored Cross-Site Scripting

CVE-2022-29005—

Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate

18RISK

open ↗

Nucleicritical

Directory Management System 1.0 - SQL Injection

CVE-2022-29006—

Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Manageme

23RISK

open ↗

Nucleicritical

Dairy Farm Shop Management System 1.0 - SQL Injection

CVE-2022-29007—

Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Ma

23RISK

open ↗

Nucleicritical

Cyber Cafe Management System 1.0 - SQL Injection

CVE-2022-29009—

Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Managem

23RISK

open ↗

Nucleicritical

Razer Sila Gaming Router - Remote Code Execution

CVE-2022-29013—

A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execut

40RISK

open ↗

Nucleihigh

Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion

CVE-2022-29014—

A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrary

23RISK

open ↗

Nucleicritical

Node.js Embedded JavaScript 3.1.6 - Template Injection

CVE-2022-29078—

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[

50RISK

open ↗

Nucleicritical

Zoho ManageEngine - Access Control Bypass

CVE-2022-29081—

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnera

40RISK

open ↗

Nucleihigh

HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery

CVE-2022-29153—

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the C

18RISK

open ↗

Nucleimedium

Nagios XI <5.8.5 - Open Redirect

CVE-2022-29272—

In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing.

18RISK

open ↗

Nucleihigh

SolarView Compact 6.00 - Local File Inclusion

CVE-2022-29298—

SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal.

50RISK

open ↗

Nucleicritical

SolarView Compact 6.00 - OS Command Injection

CVE-2022-29303CRITICALunder attack

SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.

100RISK

open ↗

Nucleihigh

Complete Online Job Search System 1.0 - Cross-Site Scripting

CVE-2022-29316—

Complete Online Job Search System v1.0 was discovered to contain a SQL injection vulnerability via /eris/index.php?q=res

18RISK

open ↗

Nucleimedium

kkFileView 4.0.0 - Cross-Site Scripting

CVE-2022-29349—

kkFileView v4.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /control

18RISK

open ↗

Nucleicritical

NETGEAR ProSafe SSL VPN firmware - SQL Injection

CVE-2022-29383—

NETGEAR ProSafe SSL VPN firmware FVS336Gv2 and FVS336Gv3 was discovered to contain a SQL injection vulnerability via USE

50RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.