Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,957cataloged exploits
32,195CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,003GitHub PoC 13,307VulnCheck XDB 8,182Nuclei 4,217Metasploit 3,462✓ verified onlyrecentpopularrisk
4,217 exploits
Nucleimedium
Apache Tomcat Examples Web Application - Cross-Site Scripting
CVE-2022-34305—
XSS in examples web application
18RISK
open ↗
Nucleimedium
PMB 7.3.10 - Cross-Site Scripting
CVE-2022-34328—
PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=author_see request to index.php.
18RISK
open ↗
Nucleicritical
ShortCode Addons - Unauthenticated Options Update
CVE-2022-34487CRITICAL
WordPress Shortcode Addons plugin <= 3.0.2 - Unauthenticated Arbitrary Option Update vulnerability
43RISK
open ↗
Nucleihigh
Digital Watchdog DW Spectrum Server 4.2.0.32842 - Information Disclosure
CVE-2022-34534—
Digital Watchdog DW Spectrum Server 4.2.0.32842 allows attackers to access sensitive infromation via a crafted API call.
18RISK
open ↗
Nucleihigh
WAVLINK WN535 G3 - Improper Access Control
CVE-2022-34576—
A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arb
18RISK
open ↗
Nucleihigh
Hospital Management System 1.0 - SQL Injection
CVE-2022-34590—
Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in /HMS
18RISK
open ↗
Nucleihigh
SpaceLogic C-Bus Home Controller <=1.31.460 - Remote Command Execution
CVE-2022-34753HIGH
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exist
78RISK
open ↗
Nucleicritical
WordPress tagDiv Composer < 3.5 - Authentication Bypass
CVE-2022-3477CRITICAL
tagDiv Composer < 3.5 - Unauthenticated Account Takeover
43RISK
open ↗
Nucleicritical
NotificationX Dropshipping < 4.4 - SQL Injection
CVE-2022-3481CRITICAL
WooCommerce Dropshipping < 4.4 - Unauthenticated SQLi
63RISK
open ↗
Nucleimedium
WordPress WPB Show Core - Cross-Site Scripting
CVE-2022-3484MEDIUM
WPB Show Core - Reflected Cross-Site Scripting
28RISK
open ↗
Nucleimedium
WordPress Related Posts <2.1.3 - Stored Cross-Site Scripting
CVE-2022-3506MEDIUM
Cross-site Scripting (XSS) - Stored in barrykooij/related-posts-for-wp
28RISK
open ↗
Nucleihigh
Zaver - Local File Inclusion
CVE-2022-38794—
Zaver through 2020-12-15 allows directory traversal via the GET /.. substring.
18RISK
open ↗
Nucleimedium
AeroCMS 0.1.1 - SQL Injection
CVE-2022-38812—
AeroCMS 0.1.1 is vulnerable to SQL Injection via the author parameter.
18RISK
open ↗
Nucleihigh
Dapr Dashboard 0.1.0-0.10.0 - Improper Access Control
CVE-2022-38817—
Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitiv
18RISK
open ↗
Nucleihigh
Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)
CVE-2022-38840HIGH
cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file uplo
56RISK
open ↗
Nucleihigh
Free5gc 3.2.1 - Information Disclosure
CVE-2022-38870HIGH
Free5gc v3.2.1 is vulnerable to Information disclosure.
36RISK
open ↗
Nucleimedium
ServiceNow - Cross-site Scripting
CVE-2022-39048MEDIUM
Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirect
28RISK
open ↗
Nucleimedium
WordPress Helloprint <1.4.7 - Cross-Site Scripting
CVE-2022-3908MEDIUM
Helloprint < 1.4.7 - Reflected Cross-Site Scripting
28RISK
open ↗
Nucleimedium
LISTSERV 17 - Cross-Site Scripting
CVE-2022-39195MEDIUM
A cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary
48RISK
open ↗
Nucleimedium
WordPress Essential Real Estate <3.9.6 - Authenticated Cross-Site Scripting
CVE-2022-3933MEDIUM
Essential Real Estate < 3.9.6 - Reflected Cross-Site-Scripting
28RISK
open ↗
Nucleimedium
WordPress FlatPM <3.0.13 - Cross-Site Scripting
CVE-2022-3934MEDIUM
Flat PM < 3.0.13 - Reflected Cross-Site Scripting
28RISK
open ↗
Nucleicritical
Sophos Mobile managed on-premises - XML External Entity Injection
CVE-2022-3980CRITICAL
An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sop
43RISK
open ↗
Nucleicritical
WordPress Booking Calendar <3.2.2 - Arbitrary File Upload
CVE-2022-3982CRITICAL
Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload
63RISK
open ↗
Nucleicritical
Fortinet FortiNAC - Arbitrary File Write
CVE-2022-39952CRITICAL
A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8
85RISK
open ↗
Nucleimedium
Jira Netic Group Export <1.0.3 - Missing Authorization
CVE-2022-39960—
The Netic Group Export add-on before 1.0.3 for Atlassian Jira does not perform authorization checks. This might allow an
23RISK
open ↗
Nucleicritical
RaspAP 2.8.7 - Unauthenticated Command Injection
CVE-2022-39986—
A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary comma
60RISK
open ↗
Nucleicritical
Symmetricom SyncServer Unauthenticated - Remote Command Execution
CVE-2022-40022CRITICAL
Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.
85RISK
open ↗
Nucleicritical
Simple Task Managing System v1.0 - SQL Injection
CVE-2022-40032CRITICAL
SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' paramet
68RISK
open ↗
Nucleimedium
Flatpress < v1.2.1 - Cross Site Scripting
CVE-2022-40047—
Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter a
18RISK
open ↗
Nucleicritical
Labstack Echo 4.8.0 - Open Redirect
CVE-2022-40083CRITICAL
Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vul
43RISK
open ↗
← previouspage 136 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.