Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,957cataloged exploits
32,195CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,003GitHub PoC 13,307VulnCheck XDB 8,182Nuclei 4,217Metasploit 3,462✓ verified onlyrecentpopularrisk
4,217 exploits
Nucleimedium
Contest Gallery - Broken Access Control
CVE-2024-43283MEDIUM
WordPress Contest Gallery plugin <= 23.1.2 - Unauthenticated Comment UserID And IP address Disclosure vulnerability
28RISK
open ↗
Nucleicritical
ZoneMinder - SQL Injection
CVE-2024-43360CRITICAL
ZoneMinder Time-based SQL Injection
43RISK
open ↗
Nucleicritical
Moodle - Remote Code Execution
CVE-2024-43425HIGH
Moodle: remote code execution via calculated question types
78RISK
open ↗
Nucleicritical
Apache HugeGraph-Server <1.5.0 - Authentication Bypass
CVE-2024-43441CRITICAL
Apache HugeGraph-Server: Fixed JWT Token(Secret)
55RISK
open ↗
Nucleimedium
osCommerce v4.0 - Cross-site Scripting
CVE-2024-4348MEDIUM
osCommerce all-products cross site scripting
28RISK
open ↗
Nucleihigh
Cloudlog - SQL Injection
CVE-2024-48259HIGH
Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign.
36RISK
open ↗
Nucleicritical
JeecgBoot v3.7.1 - SQL Injection
CVE-2024-48307CRITICAL
JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalD
75RISK
open ↗
Nucleihigh
Edito CMS - Sensitive Data Leak
CVE-2024-4836HIGH
LFI in sites managed by Edito CMS
36RISK
open ↗
Nucleihigh
Qualitor <= v8.24 - Server-Side Request Forgery
CVE-2024-48360HIGH
Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.p
36RISK
open ↗
Nucleimedium
LoLLMS WebUI - Subfolder Prediction via Path Traversal
CVE-2024-4841MEDIUM
Path Traversal in parisneo/lollms-webui
28RISK
open ↗
Nucleihigh
Netis Wifi Router - Information Disclosure
CVE-2024-48455LOW
An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi
23RISK
open ↗
Nucleicritical
NetAlert X - Arbitary File Read
CVE-2024-48766HIGH
NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and
48RISK
open ↗
Nucleicritical
ServiceNow UI Macros - Template Injection
CVE-2024-4879CRITICALunder attack
Jelly Template Injection Vulnerability in ServiceNow UI Macros
100RISK
open ↗
Nucleicritical
Progress Software WhatsUp Gold GetFileWithoutZip Directory Traversal - Remote Code Execution
CVE-2024-4885CRITICALunder attack
WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability
100RISK
open ↗
Nucleicritical
Vendure - Arbitrary File Read
CVE-2024-48914CRITICAL
Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
75RISK
open ↗
Nucleicritical
WordPress InstaWP Connect <= 0.1.0.38 - Unauthenticated User Creation
CVE-2024-4898CRITICAL
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation
63RISK
open ↗
Nucleihigh
ZimaOS <= v1.2.4 - Sensitive Information Disclosure
CVE-2024-49357HIGH
ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak
41RISK
open ↗
Nucleicritical
Plenti < v0.7.2 - OS Command Injection
CVE-2024-49380HIGH
Plenti arbitrary file write vulnerability
36RISK
open ↗
Nucleimedium
Gradio - Open Redirect
CVE-2024-4940MEDIUM
Open Redirect in gradio-app/gradio
28RISK
open ↗
Nucleihigh
Sonatype Nexus Repository Manager 3 - Local File Inclusion
CVE-2024-4956HIGH
Nexus Repository 3 - Path Traversal
61RISK
open ↗
Nucleihigh
Zitadel - User Registration Bypass
CVE-2024-49757HIGH
Zitadel User Registration Bypass Vulnerability
36RISK
open ↗
Nucleimedium
Scoold < 1.64.0 - Authentication Bypass
CVE-2024-50334HIGH
Semicolon Path Injection on API /api;/config
36RISK
open ↗
Nucleihigh
Symfony Profiler - Remote Access via Injected Arguments
CVE-2024-50340HIGH
Ability to change environment from query in symfony/runtime
48RISK
open ↗
Nucleicritical
WordPress Stacks Mobile App Builder <=5.2.3 - Authentication Bypass
CVE-2024-50477CRITICAL
WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Account Takeover vulnerability
63RISK
open ↗
Nucleicritical
WP Query Console <= 1.0 - Remote Code Execution
CVE-2024-50498CRITICAL
WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerability
75RISK
open ↗
Nucleicritical
WordPress Easy Digital Downloads <= 3.2.12 - SQL Injection
CVE-2024-5057CRITICAL
WordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerability
43RISK
open ↗
Nucleicritical
Aviatrix Controller - Remote Code Execution
CVE-2024-50603CRITICALunder attack
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutraliza
100RISK
open ↗
Nucleihigh
Cleo Harmony < 5.8.0.21 - Arbitary File Read
CVE-2024-50623CRITICALunder attackransomware
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file up
100RISK
open ↗
Nucleihigh
Nexus Repository 2 - Remote Code Execution
CVE-2024-5082HIGH
Nexus Repository 2 - Remote Code Execution
56RISK
open ↗
Nucleicritical
Hash Form <= 1.1.0 - Arbitrary File Upload
CVE-2024-5084CRITICAL
Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
75RISK
open ↗
← previouspage 135 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.