Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
72,018cataloged exploits
32,219CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,023GitHub PoC 13,334VulnCheck XDB 8,195Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
4,217 exploits
Nucleihigh
Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 2
100RISK
open ↗Nucleicritical
Kemp LoadMaster Load Balancer - Unauthenticated Command Injection
Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection
75RISK
open ↗Nucleicritical
Ivanti vTM - Authentication Bypass
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remo
100RISK
open ↗Nucleimedium
AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls
AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls
28RISK
open ↗Nucleihigh
Sensei LMS < 4.24.2 - Email Template Leak
Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak
36RISK
open ↗Nucleicritical
Woo Inquiry <= 0.1 - SQL Injection
Woo Inquiry <= 0.1 - Unauthenticated SQL Injection
63RISK
open ↗Nucleicritical
SPIP Porte Plume Plugin - Remote Code Execution
SPIP porte_plume Plugin Arbitrary PHP Execution
85RISK
open ↗Nucleihigh
WordPress Clean Login <= 1.14.5 Authenticated (Contributor+) - Local File Inclusion
Clean Login <= 1.14.5 - Authenticated (Contributor+) Local File Inclusion
36RISK
open ↗Nucleicritical
GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection
68RISK
open ↗Nucleicritical
WooCommerce Ultimate Gift Card ≤ 2.6.0 - Arbitrary File Upload
WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload
63RISK
open ↗Nucleihigh
REST API TO MiniProgram <= 4.7.1 - SQL Injection
REST API TO MiniProgram <= 4.7.1 - Unauthenticated SQL Injection
36RISK
open ↗Nucleicritical
SPIP BigUp Plugin - Remote Code Execution
SPIP Bigup Multipart File Upload OS Command Injection
85RISK
open ↗Nucleicritical
LearnPress < 4.2.7.1 - SQL Injection
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'
75RISK
open ↗← previouspage 141 / 141
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.