Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,566cataloged exploits

39,907CVEs with public exploitation

24,696lab-tested

All Referência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecent popular risk

4,513 exploits

Nucleicritical

MovableType - Remote Command Injection

CVE-2021-20837—

Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movab

60RISK

open ↗

Nucleimedium

Adobe ColdFusion - Cross-Site Scripting

CVE-2021-21087MEDIUM

ColdFusion Improper neutralization of web input during page generation could lead to arbitrary JavaScript execution in the browser

40RISK

open ↗

Nucleihigh

Spring Boot Actuator Logview Directory Traversal

CVE-2021-21234HIGH

Directory Traversal

61RISK

open ↗

Nucleihigh

OneDev < 4.0.3 - User Access Token Leak

CVE-2021-21246HIGH

Pre-Auth Access token leak

48RISK

open ↗

Nucleihigh

MinIO Browser API - Server-Side Request Forgery

CVE-2021-21287HIGH

Server-Side Request Forgery in MinIO Browser API

41RISK

open ↗

Nucleicritical

Lucee Admin - Remote Code Execution

CVE-2021-21307HIGH

Remote Code Exploit in Lucee Admin

78RISK

open ↗

Nucleihigh

Adminer <4.7.9 - Server-Side Request Forgery

CVE-2021-21311HIGHunder attack

SSRF in adminer

100RISK

open ↗

Nucleihigh

Node.JS System Information Library <5.3.1 - Remote Command Injection

CVE-2021-21315HIGHunder attack

Command Injection Vulnerability

100RISK

open ↗

Nucleicritical

XStream < 1.4.16 - Remote Code Execution

CVE-2021-21345MEDIUM

XStream is vulnerable to a Remote Command Execution attack

50RISK

open ↗

Nucleicritical

Oracle WebLogic Server - Remote Code Execution

CVE-2021-2135CRITICAL

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Suppor

43RISK

open ↗

Nucleicritical

XStream <1.4.16 - Remote Code Execution

CVE-2021-21351MEDIUM

XStream is vulnerable to an Arbitrary Code Execution attack

50RISK

open ↗

Nucleihigh

BuddyPress REST API <7.2.1 - Privilege Escalation/Remote Code Execution

CVE-2021-21389HIGH

BuddyPress privilege escalation via REST API

61RISK

open ↗

Nucleimedium

Jellyfin <10.7.0 - Local File Inclusion

CVE-2021-21402HIGH

Unauthenticated Arbitrary File Access in Jellyfin

78RISK

open ↗

Nucleicritical

SCIMono <0.0.19 - Remote Code Execution

CVE-2021-21479HIGH

In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availabi

41RISK

open ↗

Nucleimedium

ZTE MF971R - Referer authentication bypass

CVE-2021-21745—

ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use th

30RISK

open ↗

Nucleimedium

Advantech R-SeeNet 2.4.12 - Cross-Site Scripting

CVE-2021-21799CRITICAL

Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (2

48RISK

open ↗

Nucleimedium

Advantech R-SeeNet 2.4.12 - Cross-Site Scripting

CVE-2021-21800CRITICAL

Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.1

48RISK

open ↗

Nucleimedium

Advantech R-SeeNet - Cross-Site Scripting

CVE-2021-21801CRITICAL

This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web application

55RISK

open ↗

Nucleimedium

Advantech R-SeeNet - Cross-Site Scripting

CVE-2021-21802CRITICAL

This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web application

43RISK

open ↗

Nucleimedium

Advantech R-SeeNet - Cross-Site Scripting

CVE-2021-21803CRITICAL

This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web application

43RISK

open ↗

Nucleicritical

Advantech R-SeeNet 2.4.12 - OS Command Injection

CVE-2021-21805CRITICAL

An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.

55RISK

open ↗

Nucleimedium

D-Link DIR-3040 1.13B03 - Information Disclosure

CVE-2021-21816MEDIUM

An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-3040 1.13B03. A specially craft

40RISK

open ↗

Nucleicritical

Lantronix PremierWave 2050 8.9.0.0R4 - Remote Command Injection

CVE-2021-21881CRITICAL

An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix Prem

55RISK

open ↗

Nucleicritical

VMware vSphere Client (HTML5) - Remote Code Execution

CVE-2021-21972CRITICALunder attackransomware

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor

100RISK

open ↗

Nucleimedium

VMware vSphere - Server-Side Request Forgery

CVE-2021-21973MEDIUMunder attack

The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of UR

100RISK

open ↗

Nucleihigh

vRealize Operations Manager API - Server-Side Request Forgery

CVE-2021-21975CRITICALunder attackransomware

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor

100RISK

open ↗

Nucleicritical

VMware View Planner <4.6 SP1- Remote Code Execution

CVE-2021-21978—

VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input val

60RISK

open ↗

Nucleicritical

VMware vSphere Client (HTML5) - Remote Code Execution

CVE-2021-21985CRITICALunder attackransomware

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual

100RISK

open ↗

Nucleicritical

VMware vCenter Server - Arbitrary File Upload

CVE-2021-22005CRITICALunder attackransomware

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with netw

100RISK

open ↗

Nucleimedium

vCenter Server - Improper Access Control

CVE-2021-22017MEDIUMunder attack

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A mali

70RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.