Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,886cataloged exploits

32,153CVEs with public exploitation

1,932lab-tested

All Exploit-DB 22,786Referência 19,978GitHub PoC 13,282VulnCheck XDB 8,176Nuclei 4,202Metasploit 3,462✓ verified onlyrecent popular risk

4,202 exploits

Nucleimedium

Yonyou U8 13.0 - Cross-Site Scripting

CVE-2022-26263—

Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/W

30RISK

open ↗

Nucleimedium

WordPress Newspaper < 12 - Cross-Site Scripting

CVE-2022-2627MEDIUM

Newspaper < 12 - Reflected Cross-Site Scripting

28RISK

open ↗

Nucleihigh

74cmsSE v3.4.1 - Arbitrary File Read

CVE-2022-26271—

74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controlle

18RISK

open ↗

Nucleihigh

All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery

CVE-2022-2633HIGH

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side reques

41RISK

open ↗

Nucleicritical

DotCMS - Arbitrary File Upload

CVE-2022-26352CRITICALunder attackransomware

An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form req

100RISK

open ↗

Nucleimedium

HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting

CVE-2022-26564—

HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability via the prezzoperiodo4 p

18RISK

open ↗

Nucleicritical

Mingsoft MCMS v5.2.7 - SQL Injection

CVE-2022-26585—

Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.

18RISK

open ↗

Nucleicritical

Open Automation Software OAS Platform V16.00.0121 - Missing Authentication

CVE-2022-26833CRITICAL

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V

55RISK

open ↗

Nucleicritical

elFinder <=2.1.60 - Local File Inclusion

CVE-2022-26960—

connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote

30RISK

open ↗

Nucleihigh

Yearning - Directory Traversal

CVE-2022-27043—

Yearning versions 2.3.1 and 2.3.2 Interstellar GA and 2.3.4 - 2.3.6 Neptune is vulnerable to Directory Traversal.

18RISK

open ↗

Nucleicritical

Bitrix Site Manager - Remote Code Execution

CVE-2022-27228—

In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can ex

23RISK

open ↗

Nucleimedium

Openemr < 7.0.0.1 - Cross-Site Scripting

CVE-2022-2733CRITICAL

Cross-site Scripting (XSS) - Reflected in openemr/openemr

65RISK

open ↗

Nucleimedium

Kavita <0.5.4.1 - Server-Side Request Forgery

CVE-2022-2756HIGH

Server-Side Request Forgery (SSRF) in kareadita/kavita

36RISK

open ↗

Nucleicritical

QNAP QTS Photo Station External Reference - Local File Inclusion

CVE-2022-27593CRITICALunder attackransomware

DeadBolt Ransomware

95RISK

open ↗

Nucleihigh

WordPress Simple Ajax Chat <20220116 - Sensitive Information Disclosure vulnerability

CVE-2022-27849MEDIUM

WordPress Simple Ajax Chat plugin <= 20220115 - Sensitive Information Disclosure vulnerability

28RISK

open ↗

Nucleihigh

Zimbra Collaboration Suite - Memcached Command Injection

CVE-2022-27924HIGHunder attackransomware

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands i

88RISK

open ↗

Nucleimedium

Zimbra Collaboration (ZCS) - Cross Site Scripting

CVE-2022-27926MEDIUMunder attack

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboratio

63RISK

open ↗

Nucleicritical

Microfinance Management System 1.0 - SQL Injection

CVE-2022-27927—

A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application d

23RISK

open ↗

Nucleicritical

iSpy 7.2.2.0 - Authentication Bypass

CVE-2022-29775—

iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.

30RISK

open ↗

Nucleimedium

WBCE CMS 1.5.2 - Cross-Site Scripting

CVE-2022-30073—

WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php.

18RISK

open ↗

Nucleimedium

Wavlink WN-535G3 - Cross-Site Scripting

CVE-2022-30489—

WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi

18RISK

open ↗

Nucleicritical

School Dormitory Management System 1.0 - SQL Injection

CVE-2022-30512—

School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/payment_history.php:31.

18RISK

open ↗

Nucleimedium

School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting

CVE-2022-30513—

School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.p

18RISK

open ↗

Nucleimedium

School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting

CVE-2022-30514—

School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.p

18RISK

open ↗

Nucleicritical

Zyxel Firewall - OS Command Injection

CVE-2022-30525CRITICALunder attack

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat

100RISK

open ↗

Nucleimedium

Simple File List < 4.4.12 - Cross Site Scripting

CVE-2022-3062MEDIUM

Simple File List < 4.4.12 - Reflected Cross-Site Scripting

40RISK

open ↗

Nucleimedium

Atmail 6.5.0 - Cross-Site Scripting

CVE-2022-30776—

atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter.

18RISK

open ↗

Nucleimedium

Parallels H-Sphere 3.6.1713 - Cross-Site Scripting

CVE-2022-30777—

Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter.

18RISK

open ↗

Nucleihigh

Prestashop Blockwishlist 2.1.0 SQL Injection

CVE-2022-31101HIGH

SQL Injection in prestashop/blockwishlist

61RISK

open ↗

Nucleicritical

Roxy-WI - Remote Code Execution

CVE-2022-31126CRITICAL

Unauthenticated Remote Code Execution in Roxy-wi

75RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.