Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,682cataloged exploits
39,953CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
4,513 exploits
Nucleihigh
Cluster Control CMON API - Directory Traversal
CVE-2024-41628HIGH
Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and
36RISK
open ↗
Nucleihigh
OpenAM<=15.0.3 FreeMarker - Template Injection
CVE-2024-41667HIGH
OpenAM FreeMarker template injection
36RISK
open ↗
Nucleihigh
Mitel MiCollab - Authentication Bypass
CVE-2024-41713CRITICALunder attackransomware
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
100RISK
open ↗
Nucleimedium
The Events Calendar < 6.4.0.1 - Cross-site Scripting
CVE-2024-4180CRITICAL
The Events Calendar < 6.4.0.1 - Reflected XSS
63RISK
open ↗
Nucleimedium
Twisted - Open Redirect & XSS
CVE-2024-41810MEDIUM
HTML injection in HTTP redirect body
28RISK
open ↗
Nucleimedium
Open Redirect in Login Redirect - MobSF
CVE-2024-41955MEDIUM
Mobile Security Framework (MobSF) has an Open Redirect in Login Redirect
28RISK
open ↗
Nucleicritical
Roundcube Webmail - Cross-Site Scripting
CVE-2024-42009CRITICALunder attack
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea
100RISK
open ↗
Nucleihigh
Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code Execution
CVE-2024-42323HIGH
Apache HertzBeat: RCE by snakeYaml deser load malicious xml
36RISK
open ↗
Nucleimedium
BlueNet Technology Clinical Browsing System 1.2.1 - Sql Injection
CVE-2024-4257MEDIUM
BlueNet Technology Clinical Browsing System deleteStudy.php sql injection
33RISK
open ↗
Nucleicritical
Angular-Base64-Upload - Remote Code Execution
CVE-2024-42640CRITICAL
angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Explo
75RISK
open ↗
Nucleimedium
AcuToWeb server/10.5.0.7577c8b - Cross-Site Scripting
CVE-2024-42852MEDIUM
Cross Site Scripting vulnerability in AcuToWeb server v.10.5.0.7577C8b allows a remote attacker to execute arbitrary cod
28RISK
open ↗
Nucleicritical
Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via Hash
CVE-2024-4295CRITICAL
Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash
68RISK
open ↗
Nucleicritical
Cost Calculator Builder <= 3.2.15 - SQL Injection
CVE-2024-43144CRITICAL
WordPress Cost Calculator Builder plugin <= 3.2.15 - SQL Injection vulnerability
43RISK
open ↗
Nucleicritical
BerqWP <= 1.7.6 - Arbitrary File Upload
CVE-2024-43160CRITICAL
WordPress BerqWP plugin <= 1.7.6 - Unauthenticated Arbitrary File Upload vulnerability
63RISK
open ↗
Nucleihigh
LoLLMS WebUI < 9.8 - Path Traversal
CVE-2024-4322HIGH
Path Traversal in parisneo/lollms-webui
48RISK
open ↗
Nucleihigh
Gradio - Server-Side Request Forgery
CVE-2024-4325HIGH
Server-Side Request Forgery (SSRF) in gradio-app/gradio
48RISK
open ↗
Nucleimedium
Contest Gallery - Broken Access Control
CVE-2024-43283MEDIUM
WordPress Contest Gallery plugin <= 23.1.2 - Unauthenticated Comment UserID And IP address Disclosure vulnerability
28RISK
open ↗
Nucleicritical
ZoneMinder - SQL Injection
CVE-2024-43360CRITICAL
ZoneMinder Time-based SQL Injection
43RISK
open ↗
Nucleicritical
Moodle - Remote Code Execution
CVE-2024-43425HIGH
Moodle: remote code execution via calculated question types
78RISK
open ↗
Nucleicritical
Apache HugeGraph-Server <1.5.0 - Authentication Bypass
CVE-2024-43441CRITICAL
Apache HugeGraph-Server: Fixed JWT Token(Secret)
65RISK
open ↗
Nucleimedium
osCommerce v4.0 - Cross-site Scripting
CVE-2024-4348MEDIUM
osCommerce all-products cross site scripting
28RISK
open ↗
Nucleicritical
Progress Telerik Report Server - Authentication Bypass
CVE-2024-4358CRITICALunder attack
Registration Authentication Bypass Vulnerability
100RISK
open ↗
Nucleicritical
Fortra FileCatalyst Workflow <= v5.1.6 - SQL Injection
CVE-2024-5276CRITICAL
SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)
65RISK
open ↗
Nucleimedium
Ganglia Web Interface (v3.7.3 - v3.7.6) - Cross-Site Scripting
CVE-2024-52762MEDIUM
A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows atta
28RISK
open ↗
Nucleimedium
Ganglia Web Interface (v3.7.3 - v3.7.5) - Cross-Site Scripting
CVE-2024-52763MEDIUM
A cross-site scripting (XSS) vulnerability in the component /graph_all_periods.php of Ganglia-web v3.73 to v3.75 allows
28RISK
open ↗
Nucleihigh
Kerio Control v9.2.5 - CRLF Injection
CVE-2024-52875HIGH
An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertE
41RISK
open ↗
Nucleicritical
Dolibarr ERP CMS `list.php` - SQL Injection
CVE-2024-5315CRITICAL
Multiple vulnerabilities in DOLIBARR's ERP CMS
55RISK
open ↗
Nucleimedium
WordPress Events Calendar 6.8.2.1 - Information Disclosure
CVE-2024-5333MEDIUM
The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure
28RISK
open ↗
Nucleihigh
Devika - Local File Inclusion
CVE-2024-5334HIGH
Local File Read in stitionai/devika
36RISK
open ↗
Nucleicritical
SSL VPN Session Hijacking
CVE-2024-53704HIGHunder attackransomware
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authe
100RISK
open ↗
← previouspage 95 / 151next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.