Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,062cataloged exploits

31,617CVEs with public exploitation

0lab-tested

All Exploit-DB 22,467Referência 19,791GitHub PoC 13,086VulnCheck XDB 8,069Nuclei 4,187Metasploit 3,462✓ verified onlyrecent popular risk

4,187 exploits

Nucleimedium

Rudloff alltube prior to 3.0.1 - Open Redirect

CVE-2022-0692MEDIUM

Open Redirect on Rudloff/alltube in rudloff/alltube

28RISK

open ↗

Nucleicritical

WordPress Master Elements <=8.0 - SQL Injection

CVE-2022-0693—

Master Elements <= 8.0 - Unauthenticated SQLi

18RISK

open ↗

Nucleicritical

GitLab CE/EE - Information Disclosure

CVE-2022-0735CRITICAL

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star

48RISK

open ↗

Nucleicritical

Infographic Maker iList < 4.3.8 - SQL Injection

CVE-2022-0747—

Infographic Maker - iList < 4.3.8 - Unauthenticated SQL Injection

23RISK

open ↗

Nucleicritical

WordPress Simple Link Directory <7.7.2 - SQL injection

CVE-2022-0760—

Simple Link Directory < 7.7.2 - Unauthenticated SQL injection

23RISK

open ↗

Nucleimedium

WordPress Loco Translate < 2.6.1 - Cross-Site Scripting

CVE-2022-0765—

Loco Translate < 2.6.1 - Authenticated Stored Cross-Site Scripting

18RISK

open ↗

Nucleicritical

Users Ultra <= 3.1.0 - SQL Injection

CVE-2022-0769—

Users Ultra <= 3.1.0 - Unauthenticated SQL Injection

18RISK

open ↗

Nucleicritical

Documentor <= 1.5.3 - Unauthenticated SQL Injection

CVE-2022-0773—

Documentor <= 1.5.3 - Unauthenticated SQLi

30RISK

open ↗

Nucleimedium

RevealJS postMessage <4.3.0 - Cross-Site Scripting

CVE-2022-0776MEDIUM

Cross-site Scripting (XSS) - DOM in hakimel/reveal.js

28RISK

open ↗

Nucleicritical

WordPress Nirweb Support <2.8.2 - SQL Injection

CVE-2022-0781—

Nirweb support < 2.8.2 - Unauthenticated SQLi

23RISK

open ↗

Nucleihigh

Multiple Shipping Address Woocommerce < 2.0 - SQL Injection

CVE-2022-0783—

Multiple Shipping Address Woocommerce < 2.0 - Unauthenticated SQLi

18RISK

open ↗

Nucleicritical

WordPress Title Experiments Free <9.0.1 - SQL Injection

CVE-2022-0784—

Title Experiments Free < 9.0.1 - Unauthenticated SQLi

23RISK

open ↗

Nucleicritical

WordPress Daily Prayer Time <2022.03.01 - SQL Injection

CVE-2022-0785—

Daily Prayer Time < 2022.03.01 - Unauthenticated SQLi

18RISK

open ↗

Nucleicritical

WordPress KiviCare <2.3.9 - SQL Injection

CVE-2022-0786—

KiviCare < 2.3.9 - Unauthenticated SQLi

23RISK

open ↗

Nucleicritical

Limit Login Attempts (Spam Protection) < 5.1 - SQL Injection

CVE-2022-0787—

Limit Login Attempts (Spam Protection) < 5.1 - Unauthenticated SQLi

18RISK

open ↗

Nucleicritical

WordPress WP Fundraising Donation and Crowdfunding Platform <1.5.0 - SQL Injection

CVE-2022-0788—

WP Fundraising Donation and Crowdfunding Platform < 1.5.0 - Unauthenticated SQLi

18RISK

open ↗

Nucleicritical

Ubigeo de Peru < 3.6.4 - SQL Injection

CVE-2022-0814—

Ubigeo de Peru < 3.6.4 - Unauthenticated SQLi

18RISK

open ↗

Nucleicritical

WordPress BadgeOS <=3.7.0 - SQL Injection

CVE-2022-0817—

BadgeOS <= 3.7.0 - Unauthenticated SQLi

23RISK

open ↗

Nucleihigh

Webmin <1.990 - Improper Access Control

CVE-2022-0824HIGH

Improper Access Control to Remote Code Execution in webmin/webmin

78RISK

open ↗

Nucleicritical

WordPress WP Video Gallery <=1.7.1 - SQL Injection

CVE-2022-0826—

WP Video Gallery <= 1.7.1 - Unauthenticated SQLi

18RISK

open ↗

Nucleicritical

WordPress Best Books <=2.6.3 - SQL Injection

CVE-2022-0827—

Bestbooks <= 2.6.3 - Unauthenticated SQLi

18RISK

open ↗

Nucleicritical

SpeakOut Email Petitions < 2.14.15.1 - SQL Injection

CVE-2022-0846—

SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQLi

18RISK

open ↗

Nucleimedium

UpdraftPlus < 1.22.9 - Cross-Site Scripting

CVE-2022-0864—

UpdraftPlus < 1.22.9 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleicritical

WordPress ARPrice <3.6.1 - SQL Injection

CVE-2022-0867—

ARPrice Lite < 3.6.1 - Unauthenticated SQLi

23RISK

open ↗

Nucleimedium

nitely/spirit 0.12.3 - Open Redirect

CVE-2022-0869MEDIUM

Multiple Open Redirect in nitely/spirit

28RISK

open ↗

Nucleimedium

Gogs <0.12.5 - Server-Side Request Forgery

CVE-2022-0870MEDIUM

Server-Side Request Forgery (SSRF) in gogs/gogs

28RISK

open ↗

Nucleimedium

WordPress Gmedia Photo Gallery Plugin < 1.20.0 - Cross-Site Scripting

CVE-2022-0873—

Gmedia Photo Gallery < 1.20.0 - Admin+ Stored Cross-Site Scripting

18RISK

open ↗

Nucleimedium

Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting

CVE-2022-0879—

Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleicritical

Member Hero <=1.0.9 - Remote Code Execution

CVE-2022-0885—

Member Hero <= 1.0.9 - Unauthenticated RCE

18RISK

open ↗

Nucleimedium

Header Footer Code Manager < 1.1.24 - Cross-Site Scripting

CVE-2022-0899—

Header Footer Code Manager < 1.1.24 - Reflected Cross-Site Scripting

18RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.