Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,114cataloged exploits
31,649CVEs with public exploitation
0lab-tested
AllExploit-DB 22,469Referência 19,810GitHub PoC 13,116VulnCheck XDB 8,069Nuclei 4,188Metasploit 3,462✓ verified onlyrecentpopularrisk
4,188 exploits
Nucleimedium
MicroStrategy Library <11.1.3 - Cross-Site Scripting
CVE-2019-18957—
Microstrategy Library in MicroStrategy before 2019 before 11.1.3 has reflected XSS.
18RISK
open ↗
Nucleimedium
Cisco RV110W RV130W RV215W Router - Information leakage
CVE-2019-1898MEDIUM
Cisco RV110W, RV130W, and RV215W Routers Unauthenticated syslog File Access Vulnerability
40RISK
open ↗
Nucleimedium
WordPress Hero Maps Premium <=2.2.1 - Cross-Site Scripting
CVE-2019-19134—
The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index
18RISK
open ↗
Nucleimedium
Rumpus FTP Web File Manager 8.2.9.1 - Cross-Site Scripting
CVE-2019-19368—
A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1. An attacker ca
43RISK
open ↗
Nucleilow
Huawei Firewall - Local File Inclusion
CVE-2019-19411—
USG9500 with versions of V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100,
18RISK
open ↗
Nucleimedium
Cisco Small Business 200,300 and 500 Series Switches - Open Redirect
CVE-2019-1943MEDIUM
Cisco Small Business Series Switches Open Redirect Vulnerability
53RISK
open ↗
Nucleicritical
Citrix ADC and Gateway - Directory Traversal
CVE-2019-19781CRITICALunder attackransomware
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th
100RISK
open ↗
Nucleihigh
TOTOLINK/Realtek Routers - Information Disclosure
CVE-2019-19822—
A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attacker
18RISK
open ↗
Nucleihigh
TOTOLINK/Realtek Routers - Information Disclosure
CVE-2019-19823—
A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext admin
18RISK
open ↗
Nucleihigh
TOTOLINK Realtek SD Routers - Remote Command Injection
CVE-2019-19824—
On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCm
23RISK
open ↗
Nucleicritical
TOTOLINK/Realtek Routers - CAPTCHA Bypass
CVE-2019-19825—
On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"}
23RISK
open ↗
Nucleimedium
phpMyChat-Plus 1.98 - Cross-Site Scripting
CVE-2019-19908—
phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. In the URL, the
23RISK
open ↗
Nucleimedium
WordPress Email Subscribers & Newsletters <4.2.3 - Arbitrary File Retrieval
CVE-2019-19985MEDIUM
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file downloa
70RISK
open ↗
Nucleihigh
TVT NVMS 1000 - Local File Inclusion
CVE-2019-20085HIGHunder attack
TVT NVMS-1000 devices allow GET /.. Directory Traversal
100RISK
open ↗
Nucleimedium
WordPress Laborator Neon Theme 2.0 - Cross-Site Scripting
CVE-2019-20141—
An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q paramete
18RISK
open ↗
Nucleihigh
Simple Employee Records System 1.0 - Unrestricted File Upload
CVE-2019-20183—
uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension
18RISK
open ↗
Nucleimedium
WordPress CTHthemes - Cross-Site Scripting
CVE-2019-20210—
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflecte
18RISK
open ↗
Nucleihigh
Pandora FMS 7.0NG - Remote Command Injection
CVE-2019-20224—
netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary O
30RISK
open ↗
Nucleicritical
Dell KACE Systems Management Appliance (K1000) 6.4.120756 - Remote Code Execution
CVE-2019-20504—
service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 (6.4.120822) allows a remote attack
18RISK
open ↗
Nucleicritical
InfluxDB <1.7.6 - Authentication Bypass
CVE-2019-20933—
InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.
50RISK
open ↗
Nucleicritical
Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update
CVE-2019-25141CRITICAL
Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update
43RISK
open ↗
Nucleihigh
Abandoned Cart Lite for WooCommerce < 5.2.0 - Cross-Site Scripting
CVE-2019-25152HIGH
Abandoned Cart Lite for WooCommerce < 5.2.0 and Abandoned Cart Pro for WooCommerce < 7.13.0 - Stored Cross-Site Scripting
36RISK
open ↗
Nucleicritical
WordPress Advanced Access Manager - Path Traversal
CVE-2019-25213CRITICAL
Advanced Access Manager <= 5.9.8.1 - Unauthenticated Arbitrary File Read
43RISK
open ↗
Nucleihigh
BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure
CVE-2019-25246HIGH
Beward N100 H.264 VGA IP Camera M2.1.6 Authenticated File Disclosure
41RISK
open ↗
Nucleihigh
Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control
CVE-2019-2578—
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The suppo
40RISK
open ↗
Nucleimedium
Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - SQL Injection
CVE-2019-2579—
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The suppo
18RISK
open ↗
Nucleimedium
Oracle Business Intelligence - Path Traversal
CVE-2019-2588—
Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publi
50RISK
open ↗
Nucleihigh
Oracle Business Intelligence/XML Publisher - XML External Entity Injection
CVE-2019-2616HIGHunder attack
Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publi
100RISK
open ↗
Nucleicritical
Oracle WebLogic Server - Remote Command Execution
CVE-2019-2725HIGHunder attackransomware
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
100RISK
open ↗
Nucleicritical
Oracle WebLogic Server Administration Console - Remote Code Execution
CVE-2019-2729CRITICAL
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
85RISK
open ↗
← previouspage 29 / 140next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.