Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
4,513 exploits
Nucleihigh
WAVLINK WN535 G3 - Information Disclosure
A vulnerability in live_check.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router
18RISK
open ↗Nucleihigh
WAVLINK WN535 G3 - Information Disclosure
A vulnerability in live_mfg.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router in
18RISK
open ↗Nucleihigh
WAVLINK WN579 X3 M79X3.V5030.180719 - Information Disclosure
A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN579 X3 M79X3.V5030.180719 allows attackers to obtain sensi
18RISK
open ↗Nucleihigh
Codoforum 5.1 - Arbitrary File Upload
Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin
50RISK
open ↗Nucleihigh
Online Fire Reporting System v1.0 - SQL injection
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=reports&date=.
18RISK
open ↗Nucleihigh
Online Fire Reporting System v1.0 - SQL injection
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=user/manage_user&id=.
18RISK
open ↗Nucleicritical
Online Fire Reporting System v1.0 - SQL injection
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_request.
18RISK
open ↗Nucleicritical
WordPress InPost Gallery <2.1.4.1 - Local File Inclusion
InPost Gallery < 2.1.4.1 - Unauthenticated LFI to RCE
68RISK
open ↗Nucleicritical
Fortinet - Authentication Bypass
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
100RISK
open ↗Nucleimedium
Laravel Filemanager v2.5.1 - Local File Inclusion
UniSharp laravel-filemanager (aka Laravel Filemanager) before 2.6.4 allows download?working_dir=%2F.. directory traversa
18RISK
open ↗Nucleimedium
Tenda AC1200 V-W15Ev2 - Authentication Bypass
The Tenda AC1200 V-W15Ev2 V15.11.0.10(1576) router is vulnerable to improper authorization / improper session management
23RISK
open ↗Nucleimedium
kkFileView 4.1.0 - Cross-Site Scripting
kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.'
28RISK
open ↗Nucleicritical
SolarView 6.00 - Remote Command Execution
SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php
75RISK
open ↗Nucleicritical
WordPress IWS Geo Form Fields <=1.0 - SQL Injection
IWS - Geo Form Fields <= 1.0 - Unauthenticated SQLi
63RISK
open ↗Nucleicritical
Zimbra Collaboration - Unrestricted File Upload
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through ama
100RISK
open ↗Nucleihigh
WordPress Welcart e-Commerce <2.8.5 - Arbitrary File Access
Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access
36RISK
open ↗Nucleihigh
perfSONAR 4.x <= 4.4.4 - Server-Side Request Forgery
An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and exec
56RISK
open ↗Nucleimedium
ReQlogic v11.3 - Cross Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ReQlogic v11.3 allow attackers to execute arbitrary web scripts o
48RISK
open ↗Nucleimedium
RPCMS 3.0.2 - Cross-Site Scripting
RPCMS v3.0.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Search function.
28RISK
open ↗Nucleihigh
Apache ActiveMQ < 5.16.5/5.17.3 - Remote Code Execution
Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE
40RISK
open ↗Nucleimedium
Ghost CMS - User Enumeration
A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted
33RISK
open ↗Nucleihigh
F5 BIG-IP Appliance Mode - Command Injection
Appliance mode iControl REST vulnerability
78RISK
open ↗Nucleicritical
Welcart eCommerce <=2.7.7 - Local File Inclusion
WordPress Welcart eCommerce plugin <= 2.7.7 - Unauth. Directory Traversal vulnerability
36RISK
open ↗Nucleimedium
Backdrop CMS version 1.23.0 - Stored Cross Site Scripting
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' c
28RISK
open ↗Nucleimedium
Backdrop CMS version 1.23.0 - Cross Site Scripting (Stored)
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page con
28RISK
open ↗Nucleimedium
Backdrop CMS version 1.23.0 - Cross Site Scripting (Stored)
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content
28RISK
open ↗Nucleimedium
Liferay Portal - Cross-site Scripting
A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Lifera
28RISK
open ↗Nucleicritical
kkFileView 4.0 - Server-Side Request Forgery
kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java.
43RISK
open ↗Nucleicritical
pgAdmin < 6.17 - Unauthenticated Remote Code Execution
The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external Post
58RISK
open ↗Nucleicritical
Tenda 11N - Authentication Bypass
Tenda 11N with firmware version V5.07.33_cn suffers from an Authentication Bypass vulnerability.
55RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.