Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,957cataloged exploits
32,195CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,003GitHub PoC 13,307VulnCheck XDB 8,182Nuclei 4,217Metasploit 3,462✓ verified onlyrecentpopularrisk
4,217 exploits
Nucleihigh
SimpleHelp <= 5.5.7 - Unauthenticated Path Traversal
CVE-2024-57727CRITICALunder attackransomware
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enabl
100RISK
open ↗
Nucleicritical
Yii2 PHP Framework < 2.0.52 - Remote Code Execution
CVE-2024-58136CRITICALunder attack
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regres
95RISK
open ↗
Nucleicritical
Vanna - SQL injection
CVE-2024-5827CRITICAL
Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna
43RISK
open ↗
Nucleicritical
Palo Alto Expedition - Admin Account Takeover
CVE-2024-5910CRITICALunder attack
Expedition: Missing Authentication Leads to Admin Account Takeover
100RISK
open ↗
Nucleicritical
GiveWP - PHP Object Injection
CVE-2024-5932CRITICAL
GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution
85RISK
open ↗
Nucleimedium
PrivateGPT < 0.5.0 - Open Redirect
CVE-2024-5936MEDIUM
Open Redirect in imartinez/privategpt
33RISK
open ↗
Nucleimedium
Deep Sea Electronics DSE855 - Authentication Bypass
CVE-2024-5947MEDIUM
Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability
28RISK
open ↗
Nucleicritical
CZ Loan Management <= 1.1 - SQL Injection
CVE-2024-5975CRITICAL
CZ Loan Management <= 1.1 - Unauthenticated SQLi
43RISK
open ↗
Nucleicritical
Quiz Maker <= 6.5.8.3 - SQL Injection
CVE-2024-6028CRITICAL
Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter
68RISK
open ↗
Nucleihigh
Lawo AG vsm LTC Time Sync (vTimeSync) - Path Traversal
CVE-2024-6049HIGH
Unauthenticated Path Traversal
36RISK
open ↗
Nucleimedium
LocalAI - Partial Local File Read
CVE-2024-6095MEDIUM
SSRF and Partial LFI in /models/apply Endpoint in mudler/localai
28RISK
open ↗
Nucleicritical
Push Notification for Post and BuddyPress <= 1.93 - SQL Injection
CVE-2024-6159CRITICAL
Push Notification for Post and BuddyPress <=1.93 - Multiple Unauthenticated SQLi
63RISK
open ↗
Nucleimedium
TrakSYS 11.x.x - Sensitive Data Exposure
CVE-2024-6188MEDIUM
Parsec Automation TrackSYS pagedefinition direct request
28RISK
open ↗
Nucleicritical
PayPlus Payment Gateway < 6.6.9 - SQL Injection
CVE-2024-6205HIGH
PayPlus Payment Gateway < 6.6.9 - Unauthenticated SQLi
56RISK
open ↗
Nucleicritical
WordPress Keydatas ≤ 2.5.2 - Arbitrary File Upload
CVE-2024-6220CRITICAL
简数采集器 (Keydatas) <= 2.5.2 - Unauthenticated Arbitrary File Upload
55RISK
open ↗
Nucleicritical
NetScaler Console - Sensitive Information Disclosure
CVE-2024-6235CRITICAL
Sensitive information disclosure
48RISK
open ↗
Nucleihigh
LOLLMS WebUI - Absolute Path Traversal
CVE-2024-6250HIGH
Absolute Path Traversal in parisneo/lollms-webui
36RISK
open ↗
Nucleicritical
UsersWP <= 1.2.10 - Unauthenticated SQL Injection
CVE-2024-6265CRITICAL
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by'
43RISK
open ↗
Nucleimedium
WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure
CVE-2024-6289MEDIUM
WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure
28RISK
open ↗
Nucleihigh
User Profile Builder < 3.11.8 - File Upload
CVE-2024-6366CRITICAL
User Profile Builder < 3.11.8 - Unauthenticated Media Upload
68RISK
open ↗
Nucleicritical
Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite
CVE-2024-6396CRITICAL
Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim
55RISK
open ↗
Nucleihigh
Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure
CVE-2024-6420HIGH
Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure
36RISK
open ↗
Nucleicritical
WordPress Grow by Tradedoubler Plugin < 2.0.22 - Unauthenticated Local File Inclusion
CVE-2024-6460CRITICAL
Grow by Tradedoubler <= 2.0.21 - Unauthenticated LFI
63RISK
open ↗
Nucleimedium
Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting
CVE-2024-6517MEDIUM
Contact Form 7 Math Captcha <= 2.0.1 - Reflected XSS
28RISK
open ↗
Nucleimedium
WP Popups - Information Disclosure
CVE-2024-6555MEDIUM
WP Popups – WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosure
28RISK
open ↗
Nucleimedium
Campaign Monitor for WordPress - Information Disclosure
CVE-2024-6569MEDIUM
Campaign Monitor for WordPress <= 2.8.15 - Unauthenticated Full Path Disclosure
28RISK
open ↗
Nucleihigh
Lightdash v0.1024.6 - Server-Side Request Forgery
CVE-2024-6586HIGH
Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and s
36RISK
open ↗
Nucleihigh
LiteLLM - Server-Side Request Forgery
CVE-2024-6587HIGH
SSRF in berriai/litellm
48RISK
open ↗
Nucleimedium
Netgear-WN604 downloadFile.php - Information Disclosure
CVE-2024-6646MEDIUM
Netgear WN604 Web Interface downloadFile.php information disclosure
40RISK
open ↗
Nucleihigh
WordPress File Upload Plugin < 4.24.8 - Cross-Site Scripting
CVE-2024-6651MEDIUM
WordPress File Upload < 4.24.8 - Reflected XSS
33RISK
open ↗
← previouspage 134 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.