Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
4,513 exploits
Nucleicritical
WordPress Simple File List - Path Traversal
CVE-2020-12832—
WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files be
18RISK
open ↗
Nucleicritical
Wavlink Multiple AP - Remote Command Injection
CVE-2020-13117—
Wavlink WN575A4, WN579X3, and WN530G3A devices through 2020-05-15 allow unauthenticated remote users to inject commands
30RISK
open ↗
Nucleimedium
Submitty <= 20.04.01 - Open Redirect
CVE-2020-13121—
Submitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt.
18RISK
open ↗
Nucleihigh
Ultimate Addons for Elementor <= 1.24.1 - Registration Bypass
CVE-2020-13125HIGH
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the w
36RISK
open ↗
Nucleihigh
Artica Proxy Community Edition <4.30.000000 - Local File Inclusion
CVE-2020-13158—
Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parame
30RISK
open ↗
Nucleicritical
Netsweeper <=6.4.3 - Python Code Injection
CVE-2020-13167—
Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain
40RISK
open ↗
Nucleicritical
74cms - ajax_street.php 'key' SQL Injection
CVE-2020-22211—
SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php.
18RISK
open ↗
Nucleimedium
b2evolution CMS <6.11.6 - Open Redirect
CVE-2020-22840—
Open redirect vulnerability in b2evolution CMS version prior to 6.11.6 allows an attacker to perform malicious open redi
23RISK
open ↗
Nucleimedium
OPNsense <=20.1.5 - Open Redirect
CVE-2020-23015—
An open redirect issue was discovered in OPNsense through 20.1.5. The redirect parameter "url" in login page was not fil
18RISK
open ↗
Nucleimedium
Aryanic HighMail (High CMS) - Cross-Site Scripting
CVE-2020-23517—
Cross Site Scripting (XSS) vulnerability in Aryanic HighMail (High CMS) versions 2020 and before allows remote attackers
18RISK
open ↗
Nucleihigh
Kyocera Printer d-COPIA253MF - Directory Traversal
CVE-2020-23575—
A directory traversal vulnerability exists in Kyocera Printer d-COPIA253MF plus. Successful exploitation of this vulnera
30RISK
open ↗
Nucleimedium
Monstra CMS 3.0.4 - Cross-Site Scripting
CVE-2020-23697—
Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php.
18RISK
open ↗
Nucleimedium
XXL-JOB v2.2.0 — Stored Cross Site Scripting
CVE-2020-23814—
Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web scr
18RISK
open ↗
Nucleihigh
Joomla! Component GMapFP 3.5 - Arbitrary File Upload
CVE-2020-23972—
In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating
50RISK
open ↗
Nucleicritical
Import XML & RSS Feeds WordPress Plugin <= 2.0.1 Server-Side Request Forgery
CVE-2020-24148—
Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the
23RISK
open ↗
Nucleicritical
WordPress wpDiscuz <=7.0.4 - Remote Code Execution
CVE-2020-24186CRITICAL
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo
85RISK
open ↗
Nucleimedium
Mara CMS 7.5 - Cross-Site Scripting
CVE-2020-24223—
Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.
43RISK
open ↗
Nucleihigh
INTELBRAS TELEFONE IP TIP200 60.61.75.22 - Local File Inclusion
CVE-2020-24285—
INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 allows an attacker to obtain sensitive information through /cgi-bin/cgi
18RISK
open ↗
Nucleihigh
WordPress Plugin File Manager (wp-file-manager) Backup Disclosure
CVE-2020-24312—
mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htacce
23RISK
open ↗
Nucleicritical
Mongo-Express - Remote Code Execution
CVE-2020-24391—
mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this m
40RISK
open ↗
Nucleimedium
EpiServer Find <13.2.7 - Open Redirect
CVE-2020-24550—
An Open Redirect vulnerability in EpiServer Find before 13.2.7 allows an attacker to redirect users to untrusted website
18RISK
open ↗
Nucleihigh
NexusDB <4.50.23 - Local File Inclusion
CVE-2020-24571—
NexusQA NexusDB before 4.50.23 allows the reading of files via ../ directory traversal.
23RISK
open ↗
Nucleihigh
D-Link DSL 2888a - Authentication Bypass/Remote Command Execution
CVE-2020-24579—
An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. An unauthenticated attac
18RISK
open ↗
Nucleicritical
WSO2 API Manager <=3.1.0 - Blind XML External Entity Injection
CVE-2020-24589CRITICAL
The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection
48RISK
open ↗
Nucleimedium
OX Appsuite - Cross-Site Scripting
CVE-2020-24701—
OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI).
18RISK
open ↗
Nucleicritical
OsTicket < 1.14.3 - Server Side Request Forgery
CVE-2020-24881—
SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.
60RISK
open ↗
Nucleimedium
Quixplorer <=2.4.1 - Cross-Site Scripting
CVE-2020-24902MEDIUM
Quixplorer <=2.4.1 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied
28RISK
open ↗
Nucleimedium
Cute Editor for ASP.NET 6.4 - Cross-Site Scripting
CVE-2020-24903—
Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user
18RISK
open ↗
Nucleimedium
QCube Cross-Site-Scripting
CVE-2020-24912—
A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQ
18RISK
open ↗
Nucleihigh
PHP-Fusion 9.03.50 - Remote Code Execution
CVE-2020-24949—
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a cr
50RISK
open ↗
← previouspage 81 / 151next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.