Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

72,018cataloged exploits
32,219CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,023GitHub PoC 13,334VulnCheck XDB 8,195Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
4,201 exploits
Nucleihigh
WordPress Nevma Adaptive Images <0.6.67 - Local File Inclusion
CVE-2019-14205—
A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attac
30RISK
open ↗
Nucleihigh
Nevma Adaptive Images - Arbitrary File Deletion
CVE-2019-14206—
An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote a
38RISK
open ↗
Nucleimedium
Alfresco Share - Open Redirect
CVE-2019-14223—
An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share applicat
18RISK
open ↗
Nucleihigh
T24 Web Server - Local File Inclusion
CVE-2019-14251—
An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a docu
18RISK
open ↗
Nucleimedium
Aptana Jaxer 1.0.3.4547 - Local File inclusion
CVE-2019-14312—
Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This v
43RISK
open ↗
Nucleihigh
Pallets Werkzeug <0.15.5 - Local File Inclusion
CVE-2019-14322—
In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.
50RISK
open ↗
Nucleimedium
WordPress UserPro 4.9.32 - Cross-Site Scripting
CVE-2019-14470—
cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has X
60RISK
open ↗
Nucleihigh
OpenEMR <5.0.2 - Local File Inclusion
CVE-2019-14530—
An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can
50RISK
open ↗
Nucleimedium
Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting
CVE-2019-14696—
Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter.
43RISK
open ↗
Nucleimedium
osTicket < 1.12.1 - Cross-Site Scripting
CVE-2019-14750—
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It w
43RISK
open ↗
Nucleimedium
Custom 404 Pro < 3.2.8 - Cross-Site Scripting
CVE-2019-14789—
The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.
18RISK
open ↗
Nucleimedium
WP Live Chat Support <= 8.0.27 — Stored Cross-Site Scripting
CVE-2019-14950—
The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.
18RISK
open ↗
Nucleimedium
SugarCRM Enterprise 9.0.0 - Cross-Site Scripting
CVE-2019-14974—
SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.
50RISK
open ↗
Nucleihigh
Grafana - Improper Access Control
CVE-2019-15043—
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run
30RISK
open ↗
Nucleicritical
Webmin <= 1.920 - Unauthenticated Remote Command Execution
CVE-2019-15107CRITICALunder attackransomware
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RISK
open ↗
Nucleihigh
Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control
CVE-2019-2578—
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The suppo
40RISK
open ↗
Nucleimedium
Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - SQL Injection
CVE-2019-2579—
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The suppo
18RISK
open ↗
Nucleimedium
Oracle Business Intelligence - Path Traversal
CVE-2019-2588—
Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publi
50RISK
open ↗
Nucleihigh
Oracle Business Intelligence/XML Publisher - XML External Entity Injection
CVE-2019-2616HIGHunder attack
Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publi
100RISK
open ↗
Nucleicritical
Oracle WebLogic Server - Remote Command Execution
CVE-2019-2725HIGHunder attackransomware
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
100RISK
open ↗
Nucleicritical
Oracle WebLogic Server Administration Console - Remote Code Execution
CVE-2019-2729CRITICAL
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
85RISK
open ↗
Nucleihigh
Oracle Business Intelligence Publisher - XML External Entity Injection
CVE-2019-2767—
Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publi
18RISK
open ↗
Nucleicritical
Atlassian Confluence Server - Path Traversal
CVE-2019-3396CRITICALunder attackransomware
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from vers
100RISK
open ↗
Nucleihigh
Atlassian Confluence Download Attachments - Remote Code Execution
CVE-2019-3398HIGHunder attack
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote at
100RISK
open ↗
Nucleimedium
Atlassian Jira <7.13.3/8.0.0-8.1.1 - Incorrect Authorization
CVE-2019-3401—
The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote
23RISK
open ↗
Nucleimedium
Jira < 8.1.1 - Cross-Site Scripting
CVE-2019-3402—
The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows
18RISK
open ↗
Nucleimedium
Jira - Incorrect Authorization
CVE-2019-3403—
The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and fr
30RISK
open ↗
Nucleimedium
Spring Cloud Config Server - Local File Inclusion
CVE-2019-3799—
Directory Traversal with spring-cloud-config-server
60RISK
open ↗
Nucleimedium
LabKey Server Community Edition <18.3.0 - Cross-Site Scripting
CVE-2019-3911—
Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an
18RISK
open ↗
Nucleimedium
LabKey Server Community Edition <18.3.0 - Open Redirect
CVE-2019-3912—
An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL param
18RISK
open ↗
← previouspage 90 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.