Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,682cataloged exploits

39,953CVEs with public exploitation

24,696lab-tested

All Referência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecent popular risk

4,513 exploits

Nucleicritical

Dairy Farm Shop Management System 1.0 - SQL Injection

CVE-2022-29007—

Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Ma

23RISK

open ↗

Nucleicritical

Cyber Cafe Management System 1.0 - SQL Injection

CVE-2022-29009—

Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Managem

23RISK

open ↗

Nucleicritical

Razer Sila Gaming Router - Remote Code Execution

CVE-2022-29013—

A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execut

40RISK

open ↗

Nucleihigh

Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion

CVE-2022-29014—

A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrary

23RISK

open ↗

Nucleicritical

Node.js Embedded JavaScript 3.1.6 - Template Injection

CVE-2022-29078—

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[

50RISK

open ↗

Nucleicritical

Zoho ManageEngine - Access Control Bypass

CVE-2022-29081—

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnera

40RISK

open ↗

Nucleihigh

HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery

CVE-2022-29153—

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the C

18RISK

open ↗

Nucleimedium

Nagios XI <5.8.5 - Open Redirect

CVE-2022-29272—

In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing.

18RISK

open ↗

Nucleihigh

SolarView Compact 6.00 - Local File Inclusion

CVE-2022-29298—

SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal.

50RISK

open ↗

Nucleicritical

SolarView Compact 6.00 - OS Command Injection

CVE-2022-29303CRITICALunder attack

SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.

100RISK

open ↗

Nucleihigh

Complete Online Job Search System 1.0 - Cross-Site Scripting

CVE-2022-29316—

Complete Online Job Search System v1.0 was discovered to contain a SQL injection vulnerability via /eris/index.php?q=res

18RISK

open ↗

Nucleimedium

kkFileView 4.0.0 - Cross-Site Scripting

CVE-2022-29349—

kkFileView v4.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /control

18RISK

open ↗

Nucleicritical

NETGEAR ProSafe SSL VPN firmware - SQL Injection

CVE-2022-29383—

NETGEAR ProSafe SSL VPN firmware FVS336Gv2 and FVS336Gv3 was discovered to contain a SQL injection vulnerability via USE

50RISK

open ↗

Nucleimedium

WordPress Elementor Website Builder <= 3.5.5 - DOM Cross-Site Scripting

CVE-2022-29455MEDIUM

WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability

33RISK

open ↗

Nucleicritical

WSO2 Management - Arbitrary File Upload & Remote Code Execution

CVE-2022-29464CRITICALunder attackransomware

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RISK

open ↗

Nucleimedium

WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery

CVE-2022-29495MEDIUM

WordPress Popup Builder plugin <= 4.1.11 - Cross-Site Request Forgery (CSRF) leading to plugin settings update

28RISK

open ↗

Nucleimedium

WSO2 - Cross-Site Scripting

CVE-2022-29548MEDIUM

A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0,

60RISK

open ↗

Nucleicritical

iSpy 7.2.2.0 - Authentication Bypass

CVE-2022-29775—

iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.

30RISK

open ↗

Nucleimedium

WBCE CMS 1.5.2 - Cross-Site Scripting

CVE-2022-30073—

WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php.

18RISK

open ↗

Nucleimedium

Wavlink WN-535G3 - Cross-Site Scripting

CVE-2022-30489—

WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi

18RISK

open ↗

Nucleicritical

School Dormitory Management System 1.0 - SQL Injection

CVE-2022-30512—

School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/payment_history.php:31.

18RISK

open ↗

Nucleimedium

School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting

CVE-2022-30513—

School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.p

18RISK

open ↗

Nucleimedium

School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting

CVE-2022-30514—

School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.p

18RISK

open ↗

Nucleicritical

Zyxel Firewall - OS Command Injection

CVE-2022-30525CRITICALunder attack

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat

100RISK

open ↗

Nucleimedium

Simple File List < 4.4.12 - Cross Site Scripting

CVE-2022-3062MEDIUM

Simple File List < 4.4.12 - Reflected Cross-Site Scripting

40RISK

open ↗

Nucleimedium

Atmail 6.5.0 - Cross-Site Scripting

CVE-2022-30776—

atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter.

18RISK

open ↗

Nucleimedium

Parallels H-Sphere 3.6.1713 - Cross-Site Scripting

CVE-2022-30777—

Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter.

18RISK

open ↗

Nucleihigh

Prestashop Blockwishlist 2.1.0 SQL Injection

CVE-2022-31101HIGH

SQL Injection in prestashop/blockwishlist

61RISK

open ↗

Nucleicritical

Roxy-WI - Remote Code Execution

CVE-2022-31126CRITICAL

Unauthenticated Remote Code Execution in Roxy-wi

75RISK

open ↗

Nucleicritical

Roxy-WI < 6.1.1.0 - Remote Code Execution

CVE-2022-31137CRITICAL

Unauthenticated Remote Code Execution in Roxy-WI

85RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.