Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,957cataloged exploits
32,195CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,003GitHub PoC 13,307VulnCheck XDB 8,182Nuclei 4,217Metasploit 3,462✓ verified onlyrecentpopularrisk
4,217 exploits
Nucleicritical
Bloofox v0.5.2.1 - SQL Injection
CVE-2023-34756CRITICAL
bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the cid parameter at admin/index.php?mode=s
43RISK
open ↗
Nucleimedium
Hestiacp <= 1.7.7 - Cross-Site Scripting
CVE-2023-3479MEDIUM
Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp
28RISK
open ↗
Nucleihigh
Traggo Server - Local File Inclusion
CVE-2023-34843—
Traggo Server 0.3.0 is vulnerable to directory traversal via a crafted GET request.
18RISK
open ↗
Nucleicritical
Chamilo Command Injection
CVE-2023-34960—
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to ex
60RISK
open ↗
Nucleicritical
FortiWLM - Directory Traversal
CVE-2023-34990CRITICAL
A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to ex
48RISK
open ↗
Nucleicritical
Fortinet FortiWLM Unauthenticated Command Injection Vulnerability
CVE-2023-34993CRITICAL
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM versio
48RISK
open ↗
Nucleicritical
Ivanti Endpoint Manager Mobile (EPMM) - Authentication Bypass
CVE-2023-35078CRITICALunder attackransomware
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or re
100RISK
open ↗
Nucleimedium
IceWarp Webmail Server v10.2.1 - Cross Site Scripting
CVE-2023-37728—
IceWarp v10.2.1 was discovered to contain cross-site scripting (XSS) vulnerability via the color parameter.
18RISK
open ↗
Nucleimedium
Ninja Forms < 3.6.26 - Cross-Site Scripting
CVE-2023-37979HIGH
WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS)
56RISK
open ↗
Nucleimedium
Contact Form Generator <= 2.5.5 - Cross-Site Scripting
CVE-2023-37988HIGH
WordPress Contact Form Generator Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)
36RISK
open ↗
Nucleicritical
HT Mega – Absolute Addons for Elementor <= 2.2.0 - Missing Authorization to Privilege Escalation
CVE-2023-37999CRITICAL
WordPress HT Mega Absolute Addons for Elementor plugin <= 2.2.0 - Unauthenticated Privilege Escalation vulnerability
43RISK
open ↗
Nucleicritical
Ivanti Sentry - Authentication Bypass
CVE-2023-38035CRITICALunder attackransomware
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an
100RISK
open ↗
Nucleimedium
Revive Adserver 5.4.1 - Cross-Site Scripting
CVE-2023-38040—
A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions..
18RISK
open ↗
Nucleimedium
SuperWebMailer 9.00.0.01710 - Cross-Site Scripting
CVE-2023-38192—
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows superadmincreate.php XSS via crafted incorrect passwor
18RISK
open ↗
Nucleimedium
SuperWebMailer - Cross-Site Scripting
CVE-2023-38194—
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows keepalive.php XSS via a GET parameter.
18RISK
open ↗
Nucleicritical
Adobe ColdFusion - Deserialization of Untrusted Data
CVE-2023-38203CRITICALunder attackransomware
Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE
95RISK
open ↗
Nucleihigh
Adobe ColdFusion - Access Control Bypass
CVE-2023-38205HIGHunder attack
ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298
88RISK
open ↗
Nucleicritical
Dahua Smart Park Management - Arbitrary File Upload
CVE-2023-3836MEDIUM
Dahua Smart Park Management unrestricted upload
70RISK
open ↗
Nucleimedium
mooDating 1.2 - Cross-site scripting
CVE-2023-3843LOW
mooSocial mooDating URL question cross site scripting
43RISK
open ↗
Nucleihigh
Fujitsu IP Series - Hardcoded Credentials
CVE-2023-38433—
Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticat
18RISK
open ↗
Nucleimedium
MooDating 1.2 - Cross-Site Scripting
CVE-2023-3844LOW
mooSocial mooDating URL friends cross site scripting
43RISK
open ↗
Nucleimedium
MooDating 1.2 - Cross-Site Scripting
CVE-2023-3845LOW
mooSocial mooDating URL ajax_invite cross site scripting
43RISK
open ↗
Nucleimedium
MooDating 1.2 - Cross-Site Scripting
CVE-2023-3846LOW
mooSocial mooDating URL pages cross site scripting
43RISK
open ↗
Nucleimedium
MooDating 1.2 - Cross-Site scripting
CVE-2023-3847LOW
mooSocial mooDating URL users cross site scripting
43RISK
open ↗
Nucleimedium
MooDating 1.2 - Cross-site scripting
CVE-2023-3848LOW
mooSocial mooDating URL view cross site scripting
43RISK
open ↗
Nucleimedium
mooDating 1.2 - Cross-site scripting
CVE-2023-3849LOW
mooSocial mooDating URL find-a-match cross site scripting
43RISK
open ↗
Nucleimedium
CopyParty v1.8.6 - Cross Site Scripting
CVE-2023-38501MEDIUM
copyparty vulnerable to reflected cross-site scripting via k304 parameter
48RISK
open ↗
Nucleicritical
Metabase < 0.46.6.1 - Remote Code Execution
CVE-2023-38646—
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary comman
60RISK
open ↗
Nucleimedium
PHP Login System 2.0.1 - Cross-Site Scripting
CVE-2023-38875—
A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to ex
18RISK
open ↗
Nucleihigh
openSIS v9.0 - Path Traversal
CVE-2023-38879—
The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a direc
18RISK
open ↗
← previouspage 131 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.