Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,682cataloged exploits
39,953CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
4,513 exploits
Nucleimedium
WP Dream Carousel < 1.0.1b - Cross-Site Scripting
CVE-2024-13331MEDIUM
WP Dream Carousel <= 1.0.1b - Reflected XSS
28RISK
open ↗
Nucleihigh
Legull WordPress - Cross-Site Scripting
CVE-2024-13352HIGH
Legull <= 1.2.2 - Reflected XSS
36RISK
open ↗
Nucleimedium
Guten Free Options - Cross Site Scripting
CVE-2024-13492MEDIUM
Guten Free Options <= 0.9.5 - Reflected XSS
28RISK
open ↗
Nucleihigh
GamiPress <= 2.8.9 - SQL Injection
CVE-2024-13496HIGH
GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter
36RISK
open ↗
Nucleimedium
Zarinpal Paid Download - Reflected XSS
CVE-2024-13543MEDIUM
Zarinpal Paid Downloads <= 2.3 - Reflected XSS
28RISK
open ↗
Nucleihigh
WordPress Front End Users - Reflected XSS
CVE-2024-13569HIGH
Front End Users <= 3.2.32 - Reflected XSS
36RISK
open ↗
Nucleimedium
WordPress Stray Random Quotes <= 1.9.9 - Cross-Site Scripting
CVE-2024-13570MEDIUM
Stray Random Quotes <= 1.9.9 - Reflected XSS
28RISK
open ↗
Nucleimedium
WordPress 1 Click Migration Plugin < 2.3 - Information Exposure
CVE-2024-13609MEDIUM
1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.php
28RISK
open ↗
Nucleihigh
Ivanti Connect Secure - XXE
CVE-2024-22024HIGH
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Se
78RISK
open ↗
Nucleimedium
Fastify Swagger-UI - Information Disclosure
CVE-2024-22207MEDIUM
Default swagger-ui configuration exposes all files in the module
28RISK
open ↗
Nucleicritical
IBM Operational Decision Manager - JNDI Injection
CVE-2024-22319HIGH
IBM Operational Decision Manager JDNI injection
58RISK
open ↗
Nucleihigh
IBM Operational Decision Manager - Java Deserialization
CVE-2024-22320CRITICAL
IBM Operational Decision Manager code execution
65RISK
open ↗
Nucleicritical
Intel Neural Compressor <2.5.0 - SQL Injection
CVE-2024-22476CRITICAL
Improper input validation in some Intel(R) Neural Compressor software before version 2.5.0 may allow an unauthenticated
55RISK
open ↗
Nucleicritical
Netis MW5360 V1.0.1.3031 - Command Injection
CVE-2024-22729CRITICAL
NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter
65RISK
open ↗
Nucleimedium
eyoucms v.1.6.5 - Cross-Site Scripting
CVE-2024-22927MEDIUM
Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitr
28RISK
open ↗
Nucleimedium
Plone Docker - Host Header Injection
CVE-2024-23055MEDIUM
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper
28RISK
open ↗
Nucleimedium
NS-ASG Application Security Gateway 6.3 - Sql Injection
CVE-2024-2330MEDIUM
Netentsec NS-ASG Application Security Gateway index.php sql injection
33RISK
open ↗
Nucleihigh
aiohttp - Directory Traversal
CVE-2024-23334MEDIUM
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
70RISK
open ↗
Nucleimedium
Avada < 7.11.7 - Information Disclosure
CVE-2024-2340MEDIUM
Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing
33RISK
open ↗
Nucleicritical
Rejetto HTTP File Server - Template injection
CVE-2024-23692CRITICALunder attackransomware
Rejetto HTTP File Server 2.3m Unauthenticated RCE
100RISK
open ↗
Nucleicritical
Progress Kemp Flowmon - Command Injection
CVE-2024-2389CRITICAL
Flowmon Unauthenticated Command Injection Vulnerability
85RISK
open ↗
Nucleicritical
JetBrains TeamCity > 2023.11.3 - Authentication Bypass
CVE-2024-23917CRITICAL
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible
55RISK
open ↗
Nucleicritical
Exrick XMall - SQL Injection
CVE-2024-24112CRITICAL
xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.
63RISK
open ↗
Nucleicritical
Ruijie RG-NBS2009G-P - Improper Authentication
CVE-2024-24116CRITICAL
An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the syst
48RISK
open ↗
Nucleimedium
SuperWebMailer 9.31.0.01799 - Cross-Site Scripting
CVE-2024-24131MEDIUM
SuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the comp
28RISK
open ↗
Nucleicritical
TotoLink Router setMacFilterRules - Command Injection
CVE-2024-24328HIGH
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable param
36RISK
open ↗
Nucleicritical
TotoLink Router setPortForwardRules - Command Injection
CVE-2024-24329CRITICAL
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable param
43RISK
open ↗
Nucleimedium
CrateDB Database - Arbitrary File Read
CVE-2024-24565MEDIUM
CrateDB database has an arbitrary file read vulnerability
28RISK
open ↗
Nucleimedium
WPS Hide Login <= 1.9.15.2 - Login Page Disclosure
CVE-2024-2473MEDIUM
WPS Hide Login <= 1.9.15.2 - Login Page Disclosure
48RISK
open ↗
Nucleihigh
MindsDB -DNS Rebinding SSRF Protection Bypass
CVE-2024-24759CRITICAL
MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding
43RISK
open ↗
← previouspage 98 / 151next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.