Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,990cataloged exploits
32,218CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,023GitHub PoC 13,319VulnCheck XDB 8,182Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
4,217 exploits
Nucleicritical
AJ-Report < 1.4.1 - Remote Code Execution
CVE-2024-7314CRITICAL
anji-plus AJ-Report Authentication Bypass
75RISK
open ↗
Nucleicritical
TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerability
CVE-2024-7332CRITICAL
TOTOLINK CP450 Telnet Service product.ini hard-coded password
68RISK
open ↗
Nucleimedium
TVT DVR Sensitive Device - Information Disclosure
CVE-2024-7339MEDIUM
TVT DVR TD-2104TS-CL queryDevInfo information disclosure
60RISK
open ↗
Nucleihigh
W&B Weave Server - Remote Arbitrary File Leak
CVE-2024-7340HIGH
W&B Weave server remote arbitrary file leak and privilege escalation
36RISK
open ↗
Nucleimedium
Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting
CVE-2024-7354MEDIUM
Ninja Forms 3.8.6-3.8.10 - Reflected XSS
28RISK
open ↗
Nucleihigh
Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution
CVE-2024-7399HIGHunder attack
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 2
100RISK
open ↗
Nucleicritical
Kemp LoadMaster Load Balancer - Unauthenticated Command Injection
CVE-2024-7591CRITICAL
Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection
75RISK
open ↗
Nucleicritical
Ivanti vTM - Authentication Bypass
CVE-2024-7593CRITICALunder attack
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remo
100RISK
open ↗
Nucleimedium
AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls
CVE-2024-7714MEDIUM
AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls
28RISK
open ↗
Nucleihigh
Sensei LMS < 4.24.2 - Email Template Leak
CVE-2024-7786HIGH
Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak
36RISK
open ↗
Nucleicritical
Woo Inquiry <= 0.1 - SQL Injection
CVE-2024-7854CRITICAL
Woo Inquiry <= 0.1 - Unauthenticated SQL Injection
63RISK
open ↗
Nucleimedium
FastAdmin < V1.3.4.20220530 - Path Traversal
CVE-2024-7928MEDIUM
FastAdmin lang path traversal
53RISK
open ↗
Nucleicritical
SPIP Porte Plume Plugin - Remote Code Execution
CVE-2024-7954CRITICAL
SPIP porte_plume Plugin Arbitrary PHP Execution
85RISK
open ↗
Nucleimedium
Gradio - Open Redirect
CVE-2024-8021MEDIUM
Open Redirect in gradio-app/gradio
28RISK
open ↗
Nucleihigh
Flowise <= 1.8.2 Authentication Bypass
CVE-2024-8181CRITICAL
Flowise Authentication Bypass
55RISK
open ↗
Nucleihigh
WordPress Clean Login <= 1.14.5 Authenticated (Contributor+) - Local File Inclusion
CVE-2024-8252HIGH
Clean Login <= 1.14.5 - Authenticated (Contributor+) Local File Inclusion
36RISK
open ↗
Nucleicritical
GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection
CVE-2024-8353CRITICAL
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection
68RISK
open ↗
Nucleicritical
WooCommerce Ultimate Gift Card ≤ 2.6.0 - Arbitrary File Upload
CVE-2024-8425CRITICAL
WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload
63RISK
open ↗
Nucleihigh
REST API TO MiniProgram <= 4.7.1 - SQL Injection
CVE-2024-8484HIGH
REST API TO MiniProgram <= 4.7.1 - Unauthenticated SQL Injection
36RISK
open ↗
Nucleicritical
VICIdial - SQL Injection
CVE-2024-8503CRITICAL
VICIdial Unauthenticated SQL Injection
85RISK
open ↗
Nucleicritical
SPIP BigUp Plugin - Remote Code Execution
CVE-2024-8517CRITICAL
SPIP Bigup Multipart File Upload OS Command Injection
85RISK
open ↗
Nucleicritical
LearnPress < 4.2.7.1 - SQL Injection
CVE-2024-8522CRITICAL
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'
75RISK
open ↗
Nucleimedium
PAN-OS - Reflected Cross-Site Scripting
CVE-2025-0133LOW
PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and Portal
35RISK
open ↗
Nucleicritical
Ivanti Connect Secure - Stack-based Buffer Overflow
CVE-2025-0282CRITICALunder attackransomware
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7
100RISK
open ↗
Nucleicritical
Elber ESE DVB-S/S2 - Authentication Bypass
CVE-2025-0674CRITICAL
Elber Communications Equipment Authentication Bypass Using an Alternate Path or Channel
43RISK
open ↗
Nucleicritical
DocsGPT - Unauthenticated Remote Code Execution
CVE-2025-0868CRITICAL
Remote Code Execution in DocsGPT
68RISK
open ↗
Nucleicritical
GoAnywhere - Authentication Bypass
CVE-2025-10035CRITICALunder attackransomware
Deserialization Vulnerability in GoAnywhere MFT's License Servlet
100RISK
open ↗
Nucleihigh
Jinher OA - SQL Injection
CVE-2025-10090MEDIUM
Jinher OA GetTreeDate.aspx sql injection
28RISK
open ↗
Nucleihigh
WordPress OrderConvo < 14 - Path Traversal
CVE-2025-10162HIGH
OrderConvo < 14 - Unauthenticated Arbitrary File Read
56RISK
open ↗
Nucleihigh
AC Smart II - Authentication Bypass
CVE-2025-10204HIGH
Unauth Admin Reset Password on AC Smart II
36RISK
open ↗
← previouspage 137 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.