Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,901cataloged exploits
32,161CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 19,978GitHub PoC 13,282VulnCheck XDB 8,176Nuclei 4,217Metasploit 3,462✓ verified onlyrecentpopularrisk
4,202 exploits
Nucleihigh
Gitlab CE/EE 10.5 - Server-Side Request Forgery
CVE-2021-22214MEDIUM
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE
53RISK
open ↗
Nucleicritical
Micro Focus Operations Bridge Reporter - Remote Code Execution
CVE-2021-22502CRITICALunder attack
Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The
100RISK
open ↗
Nucleicritical
EVlink City < R8 V3.4.0.1 - Authentication Bypass
CVE-2021-22707—
A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to
30RISK
open ↗
Nucleimedium
Revive Adserver <5.1.0 - Open Redirect
CVE-2021-22873—
Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg
50RISK
open ↗
Nucleimedium
Ruby on Rails - Open Redirect via Host Header Injection
CVE-2021-22881—
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Sp
40RISK
open ↗
Nucleicritical
Rocket.Chat <=3.13 - NoSQL Injection
CVE-2021-22911—
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
60RISK
open ↗
Nucleicritical
F5 iControl REST - Remote Command Execution
CVE-2021-22986CRITICALunder attackransomware
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
100RISK
open ↗
Nucleimedium
MERCUSYS Mercury X18G 1.0.5 Router - Local File Inclusion
CVE-2021-23241—
MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (
23RISK
open ↗
Nucleihigh
Lodash Template - Server-Side Template Injection (RCE)
CVE-2021-23337HIGH
Command Injection
41RISK
open ↗
Nucleihigh
elFinder < 2.1.58 - Remote Code Execution
CVE-2021-23394HIGH
Remote Code Execution (RCE)
41RISK
open ↗
Nucleicritical
10Web Photo Gallery < 1.5.55 - SQL Injection
CVE-2021-24139—
Photo Gallery by 10Web < 1.5.55 - Unauthenticated SQL Injection
18RISK
open ↗
Nucleicritical
WordPress Perfect Survey <1.5.2 - SQL Injection
CVE-2021-24762—
Perfect Survey < 1.5.2 - Unauthenticated SQL Injection
60RISK
open ↗
Nucleihigh
Download Monitor < 4.4.5 - SQL Injection
CVE-2021-24786HIGH
Download Monitor < 4.4.5 - Admin+ SQL Injection
61RISK
open ↗
Nucleihigh
Header Footer Code Manager < 1.1.14 - Admin+ SQL Injection
CVE-2021-24791—
Header Footer Code Manager < 1.1.14 - Admin+ SQL Injections
18RISK
open ↗
Nucleicritical
WordPress Asgaros Forum <1.15.13 - SQL Injection
CVE-2021-24827—
Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection
23RISK
open ↗
Nucleimedium
WordPress AnyComment <0.3.5 - Open Redirect
CVE-2021-24838—
AnyComment < 0.3.5 - Open Redirect
18RISK
open ↗
Nucleicritical
WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection
CVE-2021-24849—
WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection
18RISK
open ↗
Nucleihigh
WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection
CVE-2021-24862—
RegistrationMagic < 5.0.1.6 - Admin+ SQL Injection
60RISK
open ↗
Nucleimedium
WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting
CVE-2021-24875—
eCommerce Product Catalog for WordPress < 3.0.39 - Reflected Cross-Site Scripting
18RISK
open ↗
Nucleimedium
Registrations for The Events Calendar < 2.7.5 - Authenticated Reflected Cross-Site Scripting
CVE-2021-24876—
Registrations for The Events Calendar < 2.7.5 - Reflected Cross-Site Scripting
18RISK
open ↗
Nucleimedium
SupportCandy < 2.2.7 - Reflected Cross-Site Scripting
CVE-2021-24878—
SupportCandy < 2.2.7 - Reflected Cross-Site Scripting
18RISK
open ↗
Nucleimedium
WordPress Elementor Website Builder <3.1.4 - Cross-Site Scripting
CVE-2021-24891—
Elementor < 3.4.8 - DOM Cross-Site-Scripting
23RISK
open ↗
Nucleimedium
WordPress Transposh Translation <1.0.8 - Cross-Site Scripting
CVE-2021-24910—
Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site Scripting
18RISK
open ↗
Nucleicritical
Contest Gallery < 13.1.0.6 - SQL injection
CVE-2021-24915—
Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure
23RISK
open ↗
Nucleihigh
WordPress Qubely < 1.8.6 - Unauthenticated Email Sending
CVE-2021-24916—
Qubely < 1.8.6 - Unauthenticated Arbitrary E-mail Sending
18RISK
open ↗
Nucleihigh
WordPress WPS Hide Login <1.9.1 - Information Disclosure
CVE-2021-24917—
WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header
40RISK
open ↗
Nucleimedium
WordPress Domain Check <1.0.17 - Cross-Site Scripting
CVE-2021-24926—
Domain Check < 1.0.17 - Reflected Cross-Site Scripting
43RISK
open ↗
Nucleicritical
WordPress Secure Copy Content Protection and Content Locking <2.8.2 - SQL Injection
CVE-2021-24931—
Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL Injection
60RISK
open ↗
Nucleimedium
Visual CSS Style Editor < 7.5.4 - Cross-Site Scripting
CVE-2021-24934—
Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site Scripting
18RISK
open ↗
Nucleimedium
WordPress Persian Woocommerce <=5.8.0 - Cross-Site Scripting
CVE-2021-24940—
Persian Woocommerce <= 5.8.0 - Reflected Cross-Site Scripting
18RISK
open ↗
← previouspage 115 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.