Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,682cataloged exploits

39,953CVEs with public exploitation

24,696lab-tested

All Referência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecent popular risk

4,513 exploits

Nucleimedium

Qlik Sense Enterprise - Path Traversal

CVE-2023-41266HIGHunder attackransomware

A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, Feb

100RISK

open ↗

Nucleimedium

CrafterCMS Engine - Cross-Site Scripting

CVE-2023-4136HIGH

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine

36RISK

open ↗

Nucleimedium

Ditty < 3.1.25 - Cross-Site Scripting

CVE-2023-4148MEDIUM

Ditty < 3.1.25 - Reflected XSS

28RISK

open ↗

Nucleimedium

Store Locator WordPress < 1.4.13 - Cross-Site Scripting

CVE-2023-4151MEDIUM

Store Locator WordPress < 1.4.13 - Reflected XSS

28RISK

open ↗

Nucleimedium

PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting

CVE-2023-41538—

phpjabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter.

18RISK

open ↗

Nucleimedium

EyouCms v1.6.2 - Cross-Site Scripting

CVE-2023-41597—

EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/t

18RISK

open ↗

Nucleimedium

JFinalCMS v5.0.0 - Directory Traversal

CVE-2023-41599—

An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traver

23RISK

open ↗

Nucleimedium

Emlog Pro v2.1.14 - Cross-Site Scripting

CVE-2023-41621—

A Cross Site Scripting (XSS) vulnerability was discovered in Emlog Pro v2.1.14 via the component /admin/store.php.

18RISK

open ↗

Nucleimedium

WordPress Core - Post Author Email Disclosure

CVE-2023-5561MEDIUM

WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure

28RISK

open ↗

Nucleicritical

WP Hotel Booking <= 2.0.7 - SQL Injection

CVE-2023-5652—

WP Hotel Booking < 2.0.8 - Unauthenticated SQLi

30RISK

open ↗

Nucleihigh

News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Local File Inclusion

CVE-2023-5815HIGH

News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Remote Code Execution via Local File Inclusion

36RISK

open ↗

Nucleicritical

ColumbiaSoft DocumentLocator - Improper Authentication

CVE-2023-5830HIGH

ColumbiaSoft Document Locator WebTools login improper authentication

48RISK

open ↗

Nucleimedium

phpMyFAQ < 3.2.0 - Cross-site Scripting

CVE-2023-5863HIGH

Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

36RISK

open ↗

Nucleimedium

Citrix StoreFront - Cross-Site Scripting

CVE-2023-5914MEDIUM

Cross-site scripting (XSS)

50RISK

open ↗

Nucleicritical

WordPress WPB Show Core <= 2.2 - Server-Side Request Forgery

CVE-2023-5974—

WPB Show Core <= 2.2 - Unauthenticated Server Side Request Forgery

18RISK

open ↗

Nucleicritical

Hotel Booking Lite < 4.8.5 - Arbitrary File Download & Deletion

CVE-2023-5991—

Hotel Booking Lite < 4.8.5 - Unauthenticated Arbitrary File Download & Deletion

18RISK

open ↗

Nucleimedium

WordPress Popup Builder <= 4.2.3 - Unauthenticated Stored XSS

CVE-2023-6000MEDIUM

Popup Builder < 4.2.3 - Unauthenticated Stored XSS

48RISK

open ↗

Nucleicritical

Mlflow - Arbitrary File Write

CVE-2023-6018CRITICAL

MLflow Arbitrary File Write

55RISK

open ↗

Nucleihigh

Ray Static File - Local File Inclusion

CVE-2023-6020HIGH

Ray Static File Local File Include

41RISK

open ↗

Nucleihigh

Ray API - Local File Inclusion

CVE-2023-6021HIGH

Ray Log File Local File Include

48RISK

open ↗

Nucleihigh

VertaAI ModelDB - Path Traversal

CVE-2023-6023HIGH

ModelDB Local File Include

36RISK

open ↗

Nucleicritical

LogDash Activity Log <= 1.1.3 - SQL Injection

CVE-2023-6030MEDIUM

LogDash Activity Log < 1.1.4 - Unauthenticated SQLi

28RISK

open ↗

Nucleihigh

H2O ImportFiles - Local File Inclusion

CVE-2023-6038CRITICAL

Local File Inclusion in h2oai/h2o-3

43RISK

open ↗

Nucleihigh

WP Fastest Cache 1.2.2 - SQL Injection

CVE-2023-6063—

WP Fastest Cache < 1.2.2 - Unauthenticated SQL Injection

60RISK

open ↗

Nucleimedium

Quttera Web Malware Scanner <= 3.4.1.48 - Sensitive Data Exposure

CVE-2023-6065—

Quttera Web Malware Scanner < 3.4.2.1 - Directory Listing to Sensitive Data Exposure

23RISK

open ↗

Nucleihigh

Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure

CVE-2023-6114—

Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure

30RISK

open ↗

Nucleihigh

WordPress Backup Migration <= 1.3.6 - Path Traversal

CVE-2023-6266HIGH

Backup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure

36RISK

open ↗

Nucleimedium

TOTVS Fluig Platform - Cross-Site Scripting

CVE-2023-6275LOW

TOTVS Fluig Platform mobileredir openApp.jsp cross site scripting

23RISK

open ↗

Nucleicritical

Control iD iDSecure - Authentication Bypass

CVE-2023-6329CRITICAL

Control iD iDSecure passwordCustom Authentication Bypass

75RISK

open ↗

Nucleicritical

WordPress My Calendar <3.4.22 - SQL Injection

CVE-2023-6360HIGH

The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in th

48RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.