Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
4,513 exploits
Nucleicritical
LearnPress Plugin < 4.2.0 - Unauthenticated Time-Based Blind SQLi
CVE-2022-45808CRITICAL
WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection
63RISK
open ↗
Nucleihigh
WordPress PhonePe Payment Solutions <=1.0.15 - Server-Side Request Forgery
CVE-2022-45835MEDIUM
WordPress PhonePe Payment Solutions Plugin <= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF)
40RISK
open ↗
Nucleimedium
WordPress Pie Register <3.8.2.3 - Open Redirect
CVE-2023-0552MEDIUM
Pie Register < 3.8.2.3 - Open Redirect
33RISK
open ↗
Nucleicritical
Bank Locker Management System v1.0 - SQL Injection
CVE-2023-0562HIGH
PHPGurukul Bank Locker Management System Login index.php sql injection
48RISK
open ↗
Nucleimedium
Bank Locker Management System - Cross-Site Scripting
CVE-2023-0563LOW
PHPGurukul Bank Locker Management System Assign Locker add-locker-form.php cross site scripting
35RISK
open ↗
Nucleicritical
WP Visitor Statistics (Real Time Traffic) < 6.9 - SQL Injection
CVE-2023-0600CRITICAL
WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi
63RISK
open ↗
Nucleimedium
Twittee Text Tweet <= 1.0.8 - Cross-Site Scripting
CVE-2023-0602—
Twittee Text Tweet <= 1.0.8 - Reflected XSS
18RISK
open ↗
Nucleihigh
Slimstat Analytics < 4.9.3.3 Subscriber - SQL Injection
CVE-2023-0630—
Slimstat Analytics < 4.9.3.3 - Subscriber+ SQL Injection
18RISK
open ↗
Nucleihigh
Fortra GoAnywhere MFT - Remote Code Execution
CVE-2023-0669HIGHunder attackransomware
Fortra GoAnywhere MFT License Response Servlet Command Injection
100RISK
open ↗
Nucleimedium
phpIPAM 1.5.1 - Cross-site Scripting
CVE-2023-0676LOW
Cross-site Scripting (XSS) - Reflected in phpipam/phpipam
23RISK
open ↗
Nucleimedium
PHPIPAM <v1.5.1 - Missing Authorization
CVE-2023-0678HIGH
Missing Authorization in phpipam/phpipam
48RISK
open ↗
Nucleicritical
modoboa 2.0.4 - Admin TakeOver
CVE-2023-0777HIGH
Authentication Bypass by Primary Weakness in modoboa/modoboa
61RISK
open ↗
Nucleimedium
WordPress Meta SEO <= 4.5.2 - Open Redirect
CVE-2023-0876MEDIUM
WP Meta SEO < 4.5.3 - Subscriber+ Improper Authorization causing Arbitrary Redirect
28RISK
open ↗
Nucleihigh
AP Pricing Tables Lite <= 1.1.6 - SQL Injection
CVE-2023-0900HIGH
AP Pricing Tables Lite <= 1.1.6 - Admin+ SQLi
36RISK
open ↗
Nucleimedium
WordPress Japanized for WooCommerce <2.5.5 - Cross-Site Scripting
CVE-2023-0942MEDIUM
Japanized For WooCommerce <= 2.5.4 - Reflected Cross-Site Scripting
28RISK
open ↗
Nucleicritical
Flatpress < 1.3 - Path Traversal
CVE-2023-0947HIGH
Path Traversal in flatpressblog/flatpress
36RISK
open ↗
Nucleimedium
WordPress Japanized for WooCommerce <2.5.8 - Cross-Site Scripting
CVE-2023-0948MEDIUM
Japanized For WooCommerce < 2.5.8 - Reflected XSS
28RISK
open ↗
Nucleimedium
WordPress Watu Quiz <3.3.9.1 - Cross-Site Scripting
CVE-2023-0968MEDIUM
Watu Quiz <= 3.3.9 - Reflected Cross-Site Scripting
28RISK
open ↗
Nucleicritical
Steveas WP Live Chat Shoutbox <= 1.4.2 - SQL Injection
CVE-2023-1020CRITICAL
Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated SQLi
63RISK
open ↗
Nucleimedium
WordPress GN Publisher <1.5.6 - Cross-Site Scripting
CVE-2023-1080MEDIUM
GN Publisher <= 1.5.5 - Reflected Cross-Site Scripting
28RISK
open ↗
Nucleimedium
WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting
CVE-2023-1119MEDIUM
Multiple Plugins - Cross-Site Scripting From Third-party Library
28RISK
open ↗
Nucleicritical
Mlflow <2.2.1 - Local File Inclusion
CVE-2023-1177CRITICAL
Path Traversal: '\..\filename' in mlflow/mlflow
75RISK
open ↗
Nucleimedium
Coming Soon & Maintenance < 4.1.7 - Unauthenticated Post/Page Access
CVE-2023-1263MEDIUM
CMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.6 - Information Exposure
28RISK
open ↗
Nucleimedium
osTicket < v1.16.6 - Cross-Site Scripting
CVE-2023-1315MEDIUM
Cross-site Scripting (XSS) - Reflected in osticket/osticket
28RISK
open ↗
Nucleimedium
osTicket < v1.16.6 - Cross-Site Scripting
CVE-2023-1317MEDIUM
Cross-site Scripting (XSS) - Reflected in osticket/osticket
28RISK
open ↗
Nucleimedium
osTicket < v1.16.6 - Cross-Site Scripting
CVE-2023-1318MEDIUM
Cross-site Scripting (XSS) - Generic in osticket/osticket
28RISK
open ↗
Nucleimedium
unilogies/bumsys < v2.0.2 - Clickjacking
CVE-2023-1362HIGH
Improper Restriction of Rendered UI Layers or Frames in unilogies/bumsys
36RISK
open ↗
Nucleicritical
TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection
CVE-2023-1389HIGHunder attack
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability i
100RISK
open ↗
Nucleihigh
Video List Manager <= 1.7 - SQL Injection
CVE-2023-1408HIGH
Video List Manager <= 1.7 - Admin+ SQL Injection
36RISK
open ↗
Nucleicritical
Jeecg-boot 3.5.0 qurestSql - SQL Injection
CVE-2023-1454MEDIUM
jeecg-boot qurestSql sql injection
60RISK
open ↗
← previouspage 85 / 151next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.