Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
4,513 exploits
Nucleicritical
Zimbra Collaboration - Unrestricted File Upload
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through ama
100RISK
open ↗Nucleihigh
WordPress Welcart e-Commerce <2.8.5 - Arbitrary File Access
Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access
36RISK
open ↗Nucleihigh
perfSONAR 4.x <= 4.4.4 - Server-Side Request Forgery
An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and exec
56RISK
open ↗Nucleimedium
ReQlogic v11.3 - Cross Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ReQlogic v11.3 allow attackers to execute arbitrary web scripts o
48RISK
open ↗Nucleimedium
RPCMS 3.0.2 - Cross-Site Scripting
RPCMS v3.0.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Search function.
28RISK
open ↗Nucleihigh
Apache ActiveMQ < 5.16.5/5.17.3 - Remote Code Execution
Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE
40RISK
open ↗Nucleimedium
Ghost CMS - User Enumeration
A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted
33RISK
open ↗Nucleihigh
F5 BIG-IP Appliance Mode - Command Injection
Appliance mode iControl REST vulnerability
78RISK
open ↗Nucleicritical
Welcart eCommerce <=2.7.7 - Local File Inclusion
WordPress Welcart eCommerce plugin <= 2.7.7 - Unauth. Directory Traversal vulnerability
36RISK
open ↗Nucleimedium
Backdrop CMS version 1.23.0 - Stored Cross Site Scripting
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' c
28RISK
open ↗Nucleimedium
Backdrop CMS version 1.23.0 - Cross Site Scripting (Stored)
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page con
28RISK
open ↗Nucleimedium
Backdrop CMS version 1.23.0 - Cross Site Scripting (Stored)
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content
28RISK
open ↗Nucleimedium
Liferay Portal - Cross-site Scripting
A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Lifera
28RISK
open ↗Nucleicritical
kkFileView 4.0 - Server-Side Request Forgery
kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java.
43RISK
open ↗Nucleicritical
pgAdmin < 6.17 - Unauthenticated Remote Code Execution
The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external Post
58RISK
open ↗Nucleicritical
Tenda 11N - Authentication Bypass
Tenda 11N with firmware version V5.07.33_cn suffers from an Authentication Bypass vulnerability.
55RISK
open ↗Nucleimedium
WordPress WP-Ban <1.69.1 - Stored Cross-Site Scripting
WP-Ban < 1.69.1 - Admin+ Stored XSS
28RISK
open ↗Nucleimedium
CandidATS 3.0.0 - Cross-Site Scripting.
CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of ar
28RISK
open ↗Nucleimedium
CandidATS 3.0.0 - Cross-Site Scripting.
CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbit
28RISK
open ↗Nucleimedium
CandidATS 3.0.0 - Cross-Site Scripting.
CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie o
28RISK
open ↗Nucleimedium
CandidATS 3.0.0 - Cross-Site Scripting
CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitra
28RISK
open ↗Nucleimedium
Show all comments < 7.0.1 - Cross-Site Scripting
Show All Comments < 7.0.1 - Reflected XSS
28RISK
open ↗Nucleimedium
WordPress Sunshine Photo Cart <2.9.15 - Cross-Site Scripting
Sunshine Photo Cart < 2.9.15 - Reflected XSS
28RISK
open ↗Nucleimedium
OpenCATS 0.9.6 - Cross-Site Scripting
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parame
28RISK
open ↗Nucleimedium
OpenCATS 0.9.6 - Cross-Site Scripting
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage pa
28RISK
open ↗Nucleimedium
OpenCATS 0.9.6 - Cross-Site Scripting
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback componen
28RISK
open ↗Nucleimedium
OpenCATS 0.9.6 - Cross-Site Scripting
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile compone
28RISK
open ↗Nucleimedium
OpenCATS 0.9.6 - Cross-Site Scripting
OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter i
28RISK
open ↗Nucleicritical
Login as User or Customer < 3.3 - Privilege Escalation
Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to Admin
75RISK
open ↗Nucleimedium
WordPress Panda Pods Repeater Field <1.5.4 - Cross-Site Scripting
Panda Pods Repeater Field < 1.5.4 - Reflected XSS
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.