Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
4,513 exploits
Nucleimedium
WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scripting
SEO Tools <= 4.0.7 - Reflected XSS
28RISK
open ↗Nucleihigh
WPMobile.App <= 11.56 - Open Redirect
WPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameter
36RISK
open ↗Nucleicritical
St. Joe ERP system - SQL Injection
St. Joe ERP System SingleRowQueryConverter SQL Injection
63RISK
open ↗Nucleicritical
Dahua EIMS - Unauthenticated Remote Code Execution via capture_handle
Dahua EIMS capture_handle.action RCE
68RISK
open ↗Nucleimedium
Studiocart <= 2.9.0 - Cross-Site Scripting
Studiocart <= 2.9.0 - Reflected XSS
36RISK
open ↗Nucleicritical
MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection
85RISK
open ↗Nucleihigh
Gradio 4.3-4.12 - Local File Read
Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio
56RISK
open ↗Nucleicritical
NotificationX <= 2.8.2 - SQL Injection
NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection
85RISK
open ↗Nucleihigh
ConnectWise ScreenConnect <= 23.9.7 - Path Traversal
Improper limitation of a pathname to a restricted directory (“path traversal”)
100RISK
open ↗Nucleicritical
ConnectWise ScreenConnect 23.9.7 - Authentication Bypass
Authentication bypass using an alternate path or channel
100RISK
open ↗Nucleihigh
Gradio > 4.19.1 UploadButton - Path Traversal
Local File Inclusion in gradio-app/gradio
58RISK
open ↗Nucleihigh
Tutor LMS <= 2.1.10 - SQL Injection
Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection
36RISK
open ↗Nucleimedium
Cisco Finesse - Server-Side Request Forgery (SSRF)
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker t
61RISK
open ↗Nucleicritical
Cisco SSM On-Prem <= 8-202206 - Password Reset Account Takeover
A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauth
85RISK
open ↗Nucleimedium
Memos 0.13.2 - Server-Side Request Forgery
memos vulnerable to an SSRF in /api/resource
28RISK
open ↗Nucleihigh
.NET Framework - Leaking ObjRefs via HTTP .NET Remoting
.NET Framework Information Disclosure Vulnerability
100RISK
open ↗Nucleihigh
WordPress Tourfic Plugin <= 2.11.7 - Cross-Site Scripting
WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability
36RISK
open ↗Nucleimedium
WordPress Restrict User Access <= 2.5 - Cross-Site Scripting
WordPress Restrict User Access plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability
36RISK
open ↗Nucleihigh
GeoServer Demo Request Endpoint - Server Side Request Forgery
GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost
36RISK
open ↗Nucleicritical
Telesquare TLR-2005KSH - Remote Command Execution
An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the
56RISK
open ↗Nucleimedium
VvvebJs < 1.7.5 - Arbitrary File Upload
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute
28RISK
open ↗Nucleihigh
MLflow < 2.11.3 - Path Traversal
Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow
41RISK
open ↗Nucleimedium
Unlimited Elements for Elementor <= 1.5.93 - Cross Site Scripting
WordPress Unlimited Elements for Elementor plugin <= 1.5.93 - Reflected Cross Site Scripting (XSS) vulnerability
36RISK
open ↗Nucleicritical
Ivanti EPM - Remote Code Execution
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att
100RISK
open ↗Nucleicritical
Apache StreamPipes <= 0.93.0 - Use of Cryptographically Weak PRNG in Recovery Token Generation
Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation
63RISK
open ↗Nucleihigh
GLPI 10.0.10-10.0.14 - SQL Injection
GLPI contains an SQL injection through the saved searches
48RISK
open ↗Nucleicritical
Cacti cmd_realtime.php - Command Injection
Cacti command injection in cmd_realtime.php
85RISK
open ↗Nucleimedium
WP Go Maps <= 9.0.29 - Cross-Site Scripting
WordPress WP Go Maps plugin <= 9.0.29 - Reflected Cross Site Scripting (XSS) vulnerability
36RISK
open ↗Nucleicritical
Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - NsaRescueAngel Backdoor Account
** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326
85RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.