Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,957cataloged exploits
32,195CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,003GitHub PoC 13,307VulnCheck XDB 8,182Nuclei 4,217Metasploit 3,462✓ verified onlyrecentpopularrisk
4,202 exploits
Nucleimedium
WBCE CMS v1.5.4 - Cross Site Scripting (Stored)
CVE-2022-45037MEDIUM
A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbi
28RISK
open ↗
Nucleimedium
WBCE CMS v1.5.4 - Cross Site Scripting (Stored)
CVE-2022-45038MEDIUM
A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute ar
28RISK
open ↗
Nucleihigh
Linx Sphere - Directory Traversal
CVE-2022-45269HIGH
A directory traversal vulnerability in the component SCS.Web.Server.SPI/1.0 of Linx Sphere LINX 7.35.ST15 allows attacke
36RISK
open ↗
Nucleihigh
Download Monitor <= 4.7.60 - Sensitive Information Exposure
CVE-2022-45354MEDIUM
WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure
60RISK
open ↗
Nucleimedium
WordPress Paytm Payment Gateway <=2.7.0 - Server-Side Request Forgery
CVE-2022-45362HIGH
WordPress Paytm Payment Gateway Plugin <= 2.7.0 is vulnerable to Server Side Request Forgery (SSRF)
48RISK
open ↗
Nucleimedium
Stock Ticker <= 3.23.2 - Cross-Site-Scripting
CVE-2022-45365HIGH
WordPress Stock Ticker Plugin <= 3.23.2 is vulnerable to Cross Site Scripting (XSS)
48RISK
open ↗
Nucleicritical
APsystems ECU-R Firmware - Command Injection
CVE-2022-45699CRITICAL
Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attack
65RISK
open ↗
Nucleicritical
WordPress Paytm Payment Gateway <=2.7.3 - SQL Injection
CVE-2022-45805HIGH
WordPress Paytm Payment Gateway Plugin <= 2.7.3 is vulnerable to SQL Injection
36RISK
open ↗
Nucleicritical
LearnPress Plugin < 4.2.0 - Unauthenticated Time-Based Blind SQLi
CVE-2022-45808CRITICAL
WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection
63RISK
open ↗
Nucleihigh
WordPress PhonePe Payment Solutions <=1.0.15 - Server-Side Request Forgery
CVE-2022-45835MEDIUM
WordPress PhonePe Payment Solutions Plugin <= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF)
40RISK
open ↗
Nucleimedium
Login Configurator <=2.1 - Cross-Site Scripting
CVE-2023-1893—
Login Configurator <= 2.1 - Reflected Cross-Site Scripting
18RISK
open ↗
Nucleicritical
Cisco VPN Routers - Unauthenticated Arbitrary File Upload
CVE-2023-20073MEDIUM
Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Arbitrary File Upload Vulnerability
70RISK
open ↗
Nucleimedium
Pretty Url <= 1.5.4 - Cross-Site Scripting
CVE-2023-2009MEDIUM
Pretty Url <= 1.5.4 - Admin+ Stored XSS in plugin settings
28RISK
open ↗
Nucleicritical
Cisco IOS XE Web UI - Command Injection
CVE-2023-20198CRITICALunder attack
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS
100RISK
open ↗
Nucleimedium
Custom 404 Pro < 3.7.3 - Cross-Site Scripting
CVE-2023-2023MEDIUM
Custom 404 Pro < 3.7.3 - Reflected Cross-Site Scripting
28RISK
open ↗
Nucleimedium
DedeCMS 5.7.87 - Directory Traversal
CVE-2023-2059MEDIUM
DedeCMS select_templets.php path traversal
28RISK
open ↗
Nucleicritical
VMware Aria Operations for Logs - Unauthenticated Remote Code Execution
CVE-2023-20864CRITICAL
VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with netwo
65RISK
open ↗
Nucleicritical
VMware VRealize Network Insight - Remote Code Execution
CVE-2023-20887CRITICALunder attack
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware
100RISK
open ↗
Nucleihigh
VMware Aria Operations for Networks - Remote Code Execution
CVE-2023-20888HIGH
Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network acc
58RISK
open ↗
Nucleihigh
VMware Aria Operations for Networks - Code Injection Information Disclosure Vulnerability
CVE-2023-20889HIGH
Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to
58RISK
open ↗
Nucleimedium
Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting
CVE-2023-2122—
Image Optimizer by 10web < 1.0.27 - Reflected Cross-Site Scripting
18RISK
open ↗
Nucleicritical
Purchase Order Management v1.0 - SQL Injection
CVE-2023-2130MEDIUM
SourceCodester Purchase Order Management System GET Parameter view_details.php sql injection
28RISK
open ↗
Nucleimedium
Aajoda Testimonials < 2.2.2 - Cross-Site Scripting
CVE-2023-2178—
Aajoda Testimonials < 2.2.2 - Admin+ Stored XSS
18RISK
open ↗
Nucleihigh
Oracle Peoplesoft - Unauthenticated File Read
CVE-2023-22047HIGH
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported vers
58RISK
open ↗
Nucleimedium
Adobe Connect < 12.1.5 - Local File Disclosure
CVE-2023-22232MEDIUM
Adobe Connect Improper Access Control Security feature bypass
70RISK
open ↗
Nucleimedium
Seo By 10Web < 1.2.7 - Cross-Site Scripting
CVE-2023-2224MEDIUM
Seo By 10Web < 1.2.7 - Admin+ Stored XSS
28RISK
open ↗
Nucleicritical
Modoboa < 2.1.0 - Improper Authorization
CVE-2023-2227CRITICAL
Improper Authorization in modoboa/modoboa
55RISK
open ↗
Nucleimedium
Web2py URL - Open Redirect
CVE-2023-22432MEDIUM
Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirec
28RISK
open ↗
Nucleicritical
KubePi JwtSigKey - Admin Authentication Bypass
CVE-2023-22463CRITICAL
KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token
55RISK
open ↗
Nucleihigh
KubePi <= v1.6.4 LoginLogsSearch - Unauthorized Access
CVE-2023-22478HIGH
KubePi is vulnerable to missing authorization
36RISK
open ↗
← previouspage 122 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.