Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,180cataloged exploits
31,691CVEs with public exploitation
0lab-tested
AllExploit-DB 22,469Referência 19,841GitHub PoC 13,140VulnCheck XDB 8,078Nuclei 4,190Metasploit 3,462✓ verified onlyrecentpopularrisk
4,190 exploits
Nucleimedium
Joomla! ChronoForums 2.0.11 - Local File Inclusion
CVE-2021-28377—
ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files.
18RISK
open ↗
Nucleicritical
Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)
CVE-2021-28480CRITICAL
Microsoft Exchange Server Remote Code Execution Vulnerability
85RISK
open ↗
Nucleicritical
Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)
CVE-2021-28481CRITICAL
Microsoft Exchange Server Remote Code Execution Vulnerability
55RISK
open ↗
Nucleicritical
QNAP HBS 3 - Broken Access Control
CVE-2021-28799CRITICALunder attackransomware
Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)
95RISK
open ↗
Nucleicritical
Netmask NPM Package - Server-Side Request Forgery
CVE-2021-28918—
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attacke
23RISK
open ↗
Nucleihigh
Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure
CVE-2021-28937—
The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) conta
18RISK
open ↗
Nucleimedium
rConfig 3.9.6 - Local File Inclusion
CVE-2021-29006—
rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any
18RISK
open ↗
Nucleihigh
LDAP Injection In OpenAM
CVE-2021-29156—
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacke
60RISK
open ↗
Nucleicritical
Apache OFBiz < 17.12.07 - Arbitrary Code Execution
CVE-2021-29200—
RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI
30RISK
open ↗
Nucleicritical
HPE Edgeline Infrastructure Manager <1.22 - Authentication Bypass
CVE-2021-29203—
A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infr
30RISK
open ↗
Nucleicritical
Nacos <1.4.1 - Authentication Bypass
CVE-2021-29441HIGH
Authentication bypass
78RISK
open ↗
Nucleihigh
Nacos <1.4.1 - Authentication Bypass
CVE-2021-29442HIGH
Authentication bypass
68RISK
open ↗
Nucleimedium
Ghost CMS <=4.32 - Cross-Site Scripting
CVE-2021-29484MEDIUM
DOM XSS in Theme Preview
28RISK
open ↗
Nucleimedium
Jellyfin 10.7.2 - Server Side Request Forgery
CVE-2021-29490MEDIUM
Unauthenticated GET requests through Remote Image endpoints
40RISK
open ↗
Nucleihigh
XStream <1.4.17 - Remote Code Execution
CVE-2021-29505HIGH
XStream is vulnerable to a Remote Command Execution attack
58RISK
open ↗
Nucleimedium
Prometheus - Open Redirect
CVE-2021-29622MEDIUM
Arbitrary redirects under /new endpoint
33RISK
open ↗
Nucleimedium
Adminer <=4.8.0 - Cross-Site Scripting
CVE-2021-29625HIGH
XSS in doc_link
36RISK
open ↗
Nucleimedium
Seo Panel 4.8.0 - Cross-Site Scripting
CVE-2021-3002—
Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter.
18RISK
open ↗
Nucleimedium
SysAid Technologies 20.3.64 b14 - Cross-Site Scripting
CVE-2021-30049—
SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI.
18RISK
open ↗
Nucleicritical
Laminas Project laminas-http - Remote Code Execution
CVE-2021-3007—
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead
60RISK
open ↗
Nucleicritical
Kaseya VSA < 9.5.7 - Credential Disclosure via Windows Agent
CVE-2021-30116CRITICALunder attackransomware
Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6
95RISK
open ↗
Nucleicritical
Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Execution
CVE-2021-30118CRITICAL
Unauthenticated Remote Code Execution in Kaseya VSA < v9.5.5
55RISK
open ↗
Nucleicritical
Apache OFBiz <17.12.07 - Arbitrary Code Execution
CVE-2021-30128—
Unsafe deserialization in Apache OFBiz
60RISK
open ↗
Nucleimedium
Php-mod/curl Library <2.3.2 - Cross-Site Scripting
CVE-2021-30134MEDIUM
php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key paramet
28RISK
open ↗
Nucleimedium
Sidekiq <=6.2.0 - Cross-Site Scripting
CVE-2021-30151—
Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explore
18RISK
open ↗
Nucleihigh
Intelbras WIN 300/WRN 342 - Credentials Disclosure
CVE-2021-3017—
The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover creden
30RISK
open ↗
Nucleicritical
ZEROF Web Server 1.0 - SQL Injection
CVE-2021-30175—
ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page.
18RISK
open ↗
Nucleicritical
IPeakCMS 3.5 - SQL Injection
CVE-2021-3018—
ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the
43RISK
open ↗
Nucleihigh
ffay lanproxy Directory Traversal
CVE-2021-3019—
ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection t
23RISK
open ↗
Nucleihigh
Dzzoffice 2.02.1 - Cross-Site Scripting
CVE-2021-30203—
A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers
18RISK
open ↗
← previouspage 51 / 140next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.