Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,794cataloged exploits

36,057CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,459Referência 22,721GitHub PoC 14,946VulnCheck XDB 8,829Nuclei 4,350Metasploit 3,489✓ verified onlyrecent popular risk

4,350 exploits

Nucleimedium

Simple URLs < 115 - Cross Site Scripting

CVE-2023-0099—

Simple URLs < 115 - Multiple Reflected XSS

18RISK

open ↗

Nucleihigh

SonicWall SMA1000 LFI

CVE-2023-0126HIGH

Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated atta

58RISK

open ↗

Nucleihigh

Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE

CVE-2023-0159—

Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE

50RISK

open ↗

Nucleimedium

WordPress Tutor LMS <2.0.10 - Cross Site Scripting

CVE-2023-0236MEDIUM

Tutor LMS < 2.0.10 - Reflected Cross-Site Scripting

28RISK

open ↗

Nucleihigh

WordPress WP TripAdvisor Review Slider <10.8 - Authenticated SQL Injection

CVE-2023-0261HIGH

WP TripAdvisor Review Slider < 10.8 - Subscriber+ SQLi

36RISK

open ↗

Nucleicritical

PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)

CVE-2023-0297CRITICAL

Code Injection in pyload/pyload

85RISK

open ↗

Nucleimedium

ShortPixel Adaptive Images < 3.6.3 - Cross Site Scripting

CVE-2023-0334MEDIUM

ShortPixel Adaptive Images < 3.6.3 - Reflected XSS

28RISK

open ↗

Nucleimedium

WP Helper Lite < 4.3 - Cross-Site Scripting

CVE-2023-0448MEDIUM

The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resultin

40RISK

open ↗

Nucleimedium

Membership Database <= 1.0 - Cross-Site Scripting

CVE-2023-0514MEDIUM

Membership Database <= 1.0 - Reflected XSS

28RISK

open ↗

Nucleimedium

Online Security Guards Hiring System - Cross-Site Scripting

CVE-2023-0527LOW

PHPGurukul Online Security Guards Hiring System search-request.php cross site scripting

43RISK

open ↗

Nucleimedium

WordPress Pie Register <3.8.2.3 - Open Redirect

CVE-2023-0552MEDIUM

Pie Register < 3.8.2.3 - Open Redirect

33RISK

open ↗

Nucleicritical

Bank Locker Management System v1.0 - SQL Injection

CVE-2023-0562HIGH

PHPGurukul Bank Locker Management System Login index.php sql injection

48RISK

open ↗

Nucleimedium

Bank Locker Management System - Cross-Site Scripting

CVE-2023-0563LOW

PHPGurukul Bank Locker Management System Assign Locker add-locker-form.php cross site scripting

35RISK

open ↗

Nucleicritical

WP Visitor Statistics (Real Time Traffic) < 6.9 - SQL Injection

CVE-2023-0600CRITICAL

WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi

63RISK

open ↗

Nucleimedium

Twittee Text Tweet <= 1.0.8 - Cross-Site Scripting

CVE-2023-0602—

Twittee Text Tweet <= 1.0.8 - Reflected XSS

18RISK

open ↗

Nucleihigh

Slimstat Analytics < 4.9.3.3 Subscriber - SQL Injection

CVE-2023-0630—

Slimstat Analytics < 4.9.3.3 - Subscriber+ SQL Injection

18RISK

open ↗

Nucleihigh

Fortra GoAnywhere MFT - Remote Code Execution

CVE-2023-0669HIGHunder attackransomware

Fortra GoAnywhere MFT License Response Servlet Command Injection

100RISK

open ↗

Nucleimedium

phpIPAM 1.5.1 - Cross-site Scripting

CVE-2023-0676LOW

Cross-site Scripting (XSS) - Reflected in phpipam/phpipam

23RISK

open ↗

Nucleimedium

PHPIPAM <v1.5.1 - Missing Authorization

CVE-2023-0678HIGH

Missing Authorization in phpipam/phpipam

48RISK

open ↗

Nucleicritical

modoboa 2.0.4 - Admin TakeOver

CVE-2023-0777HIGH

Authentication Bypass by Primary Weakness in modoboa/modoboa

61RISK

open ↗

Nucleimedium

WordPress Meta SEO <= 4.5.2 - Open Redirect

CVE-2023-0876MEDIUM

WP Meta SEO < 4.5.3 - Subscriber+ Improper Authorization causing Arbitrary Redirect

28RISK

open ↗

Nucleihigh

AP Pricing Tables Lite <= 1.1.6 - SQL Injection

CVE-2023-0900HIGH

AP Pricing Tables Lite <= 1.1.6 - Admin+ SQLi

36RISK

open ↗

Nucleimedium

WordPress Japanized for WooCommerce <2.5.5 - Cross-Site Scripting

CVE-2023-0942MEDIUM

Japanized For WooCommerce <= 2.5.4 - Reflected Cross-Site Scripting

28RISK

open ↗

Nucleicritical

Flatpress < 1.3 - Path Traversal

CVE-2023-0947HIGH

Path Traversal in flatpressblog/flatpress

36RISK

open ↗

Nucleimedium

WordPress Japanized for WooCommerce <2.5.8 - Cross-Site Scripting

CVE-2023-0948MEDIUM

Japanized For WooCommerce < 2.5.8 - Reflected XSS

28RISK

open ↗

Nucleimedium

WordPress Watu Quiz <3.3.9.1 - Cross-Site Scripting

CVE-2023-0968MEDIUM

Watu Quiz <= 3.3.9 - Reflected Cross-Site Scripting

28RISK

open ↗

Nucleicritical

Steveas WP Live Chat Shoutbox <= 1.4.2 - SQL Injection

CVE-2023-1020CRITICAL

Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated SQLi

63RISK

open ↗

Nucleimedium

WordPress GN Publisher <1.5.6 - Cross-Site Scripting

CVE-2023-1080MEDIUM

GN Publisher <= 1.5.5 - Reflected Cross-Site Scripting

28RISK

open ↗

Nucleimedium

WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting

CVE-2023-1119MEDIUM

Multiple Plugins - Cross-Site Scripting From Third-party Library

28RISK

open ↗

Nucleicritical

Mlflow <2.2.1 - Local File Inclusion

CVE-2023-1177CRITICAL

Path Traversal: '\..\filename' in mlflow/mlflow

75RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.