Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,957cataloged exploits
32,195CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,003GitHub PoC 13,307VulnCheck XDB 8,182Nuclei 4,217Metasploit 3,462✓ verified onlyrecentpopularrisk
4,217 exploits
Nucleicritical
Login as User or Customer < 3.3 - Privilege Escalation
CVE-2022-4305CRITICAL
Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to Admin
75RISK
open ↗
Nucleimedium
WordPress Panda Pods Repeater Field <1.5.4 - Cross-Site Scripting
CVE-2022-4306MEDIUM
Panda Pods Repeater Field < 1.5.4 - Reflected XSS
28RISK
open ↗
Nucleihigh
kkFileView 4.1.0 - Server-Side Request Forgery
CVE-2022-43140HIGH
kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.control
36RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross Site Scripting
CVE-2022-43164MEDIUM
A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of
28RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross Site Scripting
CVE-2022-43165MEDIUM
A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) o
28RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross Site Scripting
CVE-2022-43166MEDIUM
A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) o
28RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross Site Scripting
CVE-2022-43167MEDIUM
A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_aler
28RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross-Site Scripting
CVE-2022-43169MEDIUM
A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/use
28RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross Site Scripting
CVE-2022-43170MEDIUM
A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_con
28RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross-Site Scripting
CVE-2022-43185MEDIUM
A stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows atta
28RISK
open ↗
Nucleimedium
WordPress Events Calendar <1.4.5 - Cross-Site Scripting
CVE-2022-4320MEDIUM
WordPress Events Calendar Plugin < 1.4.5 - Multiple Reflected XSS
28RISK
open ↗
Nucleimedium
PDF Generator for WordPress < 1.1.2 - Cross Site Scripting
CVE-2022-4321MEDIUM
PDF Generator for WordPress < 1.1.2 - Reflected XSS
28RISK
open ↗
Nucleimedium
WordPress Post Status Notifier Lite <1.10.1 - Cross-Site Scripting
CVE-2022-4325MEDIUM
Post Status Notifier Lite < 1.10.1 - Reflected XSS
28RISK
open ↗
Nucleicritical
WooCommerce Checkout Field Manager < 18.0 - Arbitrary File Upload
CVE-2022-4328CRITICAL
WooCommerce Checkout Field Manager < 18.0 - Unauthenticated Arbitrary File Upload
63RISK
open ↗
Nucleicritical
Mingsoft MCMS - SQL Injection
CVE-2022-4375MEDIUM
Mingsoft MCMS list sql injection
28RISK
open ↗
Nucleihigh
Hitachi Pentaho Business Analytics Server - Remote Code Execution
CVE-2022-43769HIGHunder attack
Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
100RISK
open ↗
Nucleihigh
Hitachi Pentaho Business Analytics Server - Bypass Authorization
CVE-2022-43939HIGHunder attack
Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions
100RISK
open ↗
Nucleicritical
WebTareas 2.4p5 - SQL Injection
CVE-2022-44290CRITICAL
webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php
43RISK
open ↗
Nucleicritical
WebTareas 2.4p5 - SQL Injection
CVE-2022-44291CRITICAL
webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.
43RISK
open ↗
Nucleihigh
WAVLINK Quantum D4G (WL-WN531G3) - Information Disclosure
CVE-2022-44356HIGH
WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access contr
36RISK
open ↗
Nucleicritical
WordPress Fontsy <=1.8.6 - SQL Injection
CVE-2022-4447CRITICAL
Fontsy <= 1.8.6 - Multiple Unauthenticated SQLi
63RISK
open ↗
Nucleicritical
Cryptocurrency Widgets Pack <= 1.8.1 - SQL Injection
CVE-2022-44588CRITICAL
WordPress Cryptocurrency Widgets Pack Plugin <=1.8.1 is vulnerable to SQL Injection
43RISK
open ↗
Nucleicritical
PrestaShop lgcookieslaw - SQL Injection
CVE-2022-44727CRITICAL
The EU Cookie Law GDPR (Banner + Blocker) module before 2.1.3 for PrestaShop allows SQL Injection via a cookie ( lgcooki
43RISK
open ↗
Nucleicritical
CentOS Web Panel 7 <0.9.8.1147 - Remote Code Execution
CVE-2022-44877CRITICALunder attack
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execut
100RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross Site Scripting
CVE-2022-44944MEDIUM
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement f
28RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross-Site Scripting
CVE-2022-44946MEDIUM
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function
28RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross Site Scripting
CVE-2022-44947MEDIUM
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feat
28RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross-Site Scripting
CVE-2022-44948MEDIUM
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group fea
28RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross Site Scripting
CVE-2022-44949MEDIUM
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field func
28RISK
open ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross Site Scripting
CVE-2022-44950MEDIUM
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field func
28RISK
open ↗
← previouspage 124 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.