Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,760cataloged exploits
32,083CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 19,934GitHub PoC 13,235VulnCheck XDB 8,150Nuclei 4,193Metasploit 3,462✓ verified onlyrecentpopularrisk
4,193 exploits
Nucleihigh
WP Fastest Cache 1.2.2 - SQL Injection
CVE-2023-6063—
WP Fastest Cache < 1.2.2 - Unauthenticated SQL Injection
40RISK
open ↗
Nucleimedium
Quttera Web Malware Scanner <= 3.4.1.48 - Sensitive Data Exposure
CVE-2023-6065—
Quttera Web Malware Scanner < 3.4.2.1 - Directory Listing to Sensitive Data Exposure
23RISK
open ↗
Nucleihigh
Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure
CVE-2023-6114—
Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure
30RISK
open ↗
Nucleihigh
WordPress Backup Migration <= 1.3.6 - Path Traversal
CVE-2023-6266HIGH
Backup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure
36RISK
open ↗
Nucleimedium
TOTVS Fluig Platform - Cross-Site Scripting
CVE-2023-6275LOW
TOTVS Fluig Platform mobileredir openApp.jsp cross site scripting
23RISK
open ↗
Nucleicritical
Control iD iDSecure - Authentication Bypass
CVE-2023-6329CRITICAL
Control iD iDSecure passwordCustom Authentication Bypass
75RISK
open ↗
Nucleicritical
WordPress My Calendar <3.4.22 - SQL Injection
CVE-2023-6360HIGH
The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in th
48RISK
open ↗
Nucleimedium
OpenCMS 14 & 15 - Cross Site Scripting
CVE-2023-6379MEDIUM
Cross-site Scripting in Alkacon Software OpenCms
28RISK
open ↗
Nucleimedium
OpenCms 14 & 15 - Open Redirect
CVE-2023-6380MEDIUM
Open Redirect in Alkacon Software OpenCms
28RISK
open ↗
Nucleimedium
WordPress Toolbar <= 2.2.6 - Open Redirect
CVE-2023-6389MEDIUM
WordPress Toolbar <= 2.2.6 - Open Redirect
33RISK
open ↗
Nucleimedium
WordPress Download Manager - File Password Exposure
CVE-2023-6421HIGH
Download Manager < 3.2.83 - Unauthenticated Protected File Download Password Leak
36RISK
open ↗
Nucleimedium
Seriously Simple Podcasting < 3.0.0 - Information Disclosure
CVE-2023-6444MEDIUM
Seriously Simple Podcasting < 3.0.0 - Unauthenticated Administrator Email Disclosure
28RISK
open ↗
Nucleihigh
Prime Mover < 1.9.3 - Sensitive Data Exposure
CVE-2023-6505HIGH
Prime Mover < 1.9.3 - Directory Listing to Sensitive Data Exposure
48RISK
open ↗
Nucleicritical
Citrix Netscaler ADC & Gateway - Out-Of-Bounds Memory Read
CVE-2023-6549HIGHunder attack
Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Un
78RISK
open ↗
Nucleicritical
Worpress Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution
CVE-2023-6553CRITICAL
Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution
85RISK
open ↗
Nucleihigh
LearnPress <= 4.2.5.7 - SQL Injection
CVE-2023-6567CRITICAL
LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by
75RISK
open ↗
Nucleimedium
Mlflow - Cross-Site Scripting
CVE-2023-6568MEDIUM
Reflected XSS via Content-Type Header in mlflow/mlflow
28RISK
open ↗
Nucleimedium
WordPress FastDup <= 2.1.9 Sensitive Information Exposure - Directory Listing
CVE-2023-6592MEDIUM
FastDup – Fastest WordPress Migration & Duplicator < 2.2 - Directory Listing to Account Takeover and Sensitive Data Exposure
28RISK
open ↗
Nucleicritical
Essential Blocks < 4.4.3 - Local File Inclusion
CVE-2023-6623CRITICAL
Essential Blocks < 4.4.3 - Unauthenticated Local File Inclusion
75RISK
open ↗
Nucleicritical
LearnPress < 4.2.5.8 - Remote Code Execution
CVE-2023-6634HIGH
LearnPress <= 4.2.5.7 - Command Injection
56RISK
open ↗
Nucleihigh
Hongjing e-HR 2020 - SQL Injection
CVE-2023-6655HIGH
Hongjing e-HR Login Interface loadhistroyorgtree sql injection
36RISK
open ↗
Nucleimedium
WP Go Maps (formerly WP Google Maps) < 9.0.29 - Cross-Site Scripting
CVE-2023-6697MEDIUM
WP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site Scripting
28RISK
open ↗
Nucleicritical
WordPress WP Clone <= 2.4.2 - Database Backup Exposure
CVE-2023-6750HIGH
Clone < 2.4.3 - Unauthenticated Backup Download
36RISK
open ↗
Nucleimedium
Payment Gateway for Telcell < 2.0.4 - Open Redirect
CVE-2023-6786MEDIUM
Payment Gateway for Telcell <= 2.0.1 - Unauthenticated Open Redirect
28RISK
open ↗
Nucleicritical
WordPress File Manager <= 7.2.1 - Directory Traversal
CVE-2023-6825CRITICAL
File Manager And File Manager Pro (Multiple Versions) - Directory Traversal
43RISK
open ↗
Nucleihigh
mlflow - Path Traversal
CVE-2023-6831HIGH
Path Traversal: '\..\filename' in mlflow/mlflow
36RISK
open ↗
Nucleicritical
WordPress POST SMTP Mailer <= 2.8.7 - Authorization Bypass
CVE-2023-6875CRITICAL
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API
85RISK
open ↗
Nucleicritical
Hikvision IP ping.php - Command Execution
CVE-2023-6895MEDIUM
Hikvision Intercom Broadcasting System ping.php os command injection
70RISK
open ↗
Nucleihigh
Mlflow <2.9.2 - Path Traversal
CVE-2023-6909HIGH
Path Traversal: '\..\filename' in mlflow/mlflow
58RISK
open ↗
Nucleicritical
Better Search Replace < 1.4.5 - PHP Object Injection
CVE-2023-6933HIGH
Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection
68RISK
open ↗
← previouspage 64 / 140next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.