Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
71,062cataloged exploits
31,617CVEs with public exploitation
0lab-tested
AllExploit-DB 22,467Referência 19,791GitHub PoC 13,086VulnCheck XDB 8,069Nuclei 4,187Metasploit 3,462✓ verified onlyrecentpopularrisk
4,187 exploits
Nucleihigh
Embedthis GoAhead <3.6.5 - Remote Code Execution
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. T
100RISK
open ↗Nucleicritical
DedeCMS 5.7 - SQL Injection
DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.
23RISK
open ↗Nucleicritical
Kentico - Installer Privilege Escalation
Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visit
30RISK
open ↗Nucleihigh
Episerver 7 - Blind XML External Entity Injection
XML external entity (XXE) vulnerability in Episerver 7 patch 4 and earlier allows remote attackers to read arbitrary fil
18RISK
open ↗Nucleimedium
AvantFAX 3.3.3 - Cross-Site Scripting
AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI, as demonstrated by a parameter whose name con
18RISK
open ↗Nucleicritical
Fastjson Insecure Deserialization - Remote Code Execution
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attac
30RISK
open ↗Nucleicritical
Kaseya VSA 2017 ConnectWise ManagedITSync - Remote Code Execution
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that
100RISK
open ↗Nucleimedium
AdPush < 1.44 - Cross-Site Scripting
The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Contact Form Multi by BestWebSoft < 1.2.1 - Cross-Site Scripting
The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Contact Form by BestWebSoft < 4.0.6 - Cross-Site Scripting
The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Contact Form to DB by BestWebSoft < 1.5.7 - Cross-Site Scripting
The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Custom Admin Page by BestWebSoft < 0.1.2 - Cross-Site Scripting
The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Custom Search by BestWebSoft < 1.36 - Cross-Site Scripting
The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Htaccess by BestWebSoft < 1.7.6 - Cross-Site Scripting
The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Social Buttons Pack by BestWebSof < 1.1.1 - Cross-Site Scripting
The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Social Login by BestWebSoft < 0.2 - Cross-Site Scripting
The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Subscriber by BestWebSoft < 1.3.5 - Cross-Site Scripting
The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
BestWebSoft's Twitter < 2.55 - Cross-Site Scripting
The twitter-plugin plugin before 2.55 for WordPress has XSS.
18RISK
open ↗Nucleimedium
LinkedIn by BestWebSoft < 1.0.5 - Cross-Site Scripting
The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Pinterest by BestWebSoft < 1.0.5 - Cross-Site Scripting
The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
SMTP by BestWebSoft < 1.1.0 - Cross-Site Scripting
The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Pagination by BestWebSoft < 1.0.7 - Cross-Site Scripting
The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
PDF & Print by BestWebSoft < 1.9.4 - Cross-Site Scripting
The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
PromoBar by BestWebSoft < 1.1.1 - Cross-Site Scripting
The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Rating by BestWebSoft < 0.2 - Cross-Site Scripting
The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Realty by BestWebSoft < 1.1.0 - Cross-Site Scripting
The realty plugin before 1.1.0 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting
The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.
18RISK
open ↗Nucleimedium
Visitors Online by BestWebSoft < 1.0.0 - Cross-Site Scripting
The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Zendesk Help Center by BestWebSoft < 1.0.5 - Cross-Site Scripting
The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.
18RISK
open ↗Nucleimedium
Google Analytics by BestWebSoft < 1.7.1 - Cross-Site Scripting
The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.
18RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.