Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,836cataloged exploits
32,133CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 19,967GitHub PoC 13,264VulnCheck XDB 8,156Nuclei 4,201Metasploit 3,462✓ verified onlyrecentpopularrisk
4,201 exploits
Nucleihigh
Dyn Business Panel Plugin <= 1.0.0 - Cross-Site Scripting
CVE-2024-13055HIGH
Dyn Business Panel <= 1.0.0 - Reflected XSS
36RISK
open ↗
Nucleihigh
WP Triggers Lite - Cross-Site Scripting
CVE-2024-13094HIGH
WP Triggers Lite <= 2.5.3 - Reflected XSS
36RISK
open ↗
Nucleimedium
WP Finance Plugin <= 1.3.6 - Cross-Site Scripting
CVE-2024-13097MEDIUM
WP Finance <= 1.3.6 - Reflected XSS
28RISK
open ↗
Nucleimedium
WordPress Email Newsletter - Reflected XSS
CVE-2024-13098MEDIUM
WP Email Newsletter <= 1.1 - Reflected XSS
28RISK
open ↗
Nucleimedium
Widget4Call WordPress - Cross-Site Scripting
CVE-2024-13099MEDIUM
Widget4call <= 1.0.7 - Reflected XSS
28RISK
open ↗
Nucleimedium
WP MediaTagger <= 4.1.1 - Cross-Site Scripting
CVE-2024-13112MEDIUM
WP MediaTagger <= 4.1.1 - Reflected XSS
28RISK
open ↗
Nucleimedium
WP Projects Portfolio <= 3.0 - Cross-Site Scripting
CVE-2024-13114MEDIUM
WP Projects Portfolio with Client Testimonials <= 3.0 - Reflected XSS
28RISK
open ↗
Nucleimedium
WordPress Download Manager < 3.3.07 - Unauthenticated Data Exposure
CVE-2024-13126MEDIUM
Download Manager < 3.3.07 - Unauthenticated Data Exposure
28RISK
open ↗
Nucleicritical
Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcardRecursive
CVE-2024-13159CRITICALunder attack
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Up
100RISK
open ↗
Nucleicritical
Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcard
CVE-2024-13160CRITICALunder attack
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Up
100RISK
open ↗
Nucleicritical
Ivanti EPM - Credential Coercion Vulnerability in GetHashForSingleFile
CVE-2024-13161CRITICALunder attack
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Up
100RISK
open ↗
Nucleimedium
Privacy Policy Genius - Cross-Site Scripting
CVE-2024-13219MEDIUM
Policy Genius <= 2.0.4 - Reflected XSS
28RISK
open ↗
Nucleimedium
WordPress Google Map Professional - Cross-Site Scripting
CVE-2024-13220MEDIUM
Google Map Professional <= 1.0 - Reflected XSS
28RISK
open ↗
Nucleimedium
Fantastic ElasticSearch Plugin <= 4.1.0 - Cross-Site Scripting
CVE-2024-13221MEDIUM
Fantastic Elasticsearch <= 4.1.0 - Reflected XSS
28RISK
open ↗
Nucleimedium
WordPress User Messages <= 1.2.4 - Reflected XSS
CVE-2024-13222MEDIUM
User Messages <= 1.2.4 - Reflected XSS
28RISK
open ↗
Nucleimedium
SlideDeck 1 Lite Content Slider - Cross-Site Scripting
CVE-2024-13224MEDIUM
SlideDeck 1 Lite Content Slider <= 1.4.8 - Reflected XSS
28RISK
open ↗
Nucleimedium
ECT Home Page Products - Reflected XSS
CVE-2024-13225MEDIUM
ECT Home Page Products <= 1.9 - Reflected XSS
28RISK
open ↗
Nucleimedium
A5 Custom Login Page - Reflected XSS
CVE-2024-13226MEDIUM
A5 Custom Login Page <= 2.8.1 - Reflected XSS
28RISK
open ↗
Nucleihigh
Ads Pro Plugin <= 4.88 - Unauthenticated SQL Injection
CVE-2024-13322HIGH
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.88 - Unauthenticated SQL Injection
36RISK
open ↗
Nucleimedium
Glossy WordPress - Reflected XSS
CVE-2024-13325MEDIUM
Glossy <= 2.3.5 - Reflected XSS
28RISK
open ↗
Nucleimedium
iBuildApp <= 0.2.0 - Reflected Cross-Site Scripting
CVE-2024-13326MEDIUM
iBuildApp <= 0.2.0 - Reflected XSS
28RISK
open ↗
Nucleimedium
Musicbox WordPress - Reflected XSS
CVE-2024-13327MEDIUM
Musicbox <= 2.0.3 - Reflected XSS
28RISK
open ↗
Nucleimedium
Giga Messenger WordPress - Cross-Site Scripting
CVE-2024-13328MEDIUM
Giga Messenger Bots <= 2.3.1 - Reflected XSS
28RISK
open ↗
Nucleihigh
JustRows WordPress - Cross-Site Scripting
CVE-2024-13330HIGH
Justrows Free <= 0.2 - Reflected XSS
36RISK
open ↗
Nucleimedium
WP Dream Carousel < 1.0.1b - Cross-Site Scripting
CVE-2024-13331MEDIUM
WP Dream Carousel <= 1.0.1b - Reflected XSS
28RISK
open ↗
Nucleihigh
Legull WordPress - Cross-Site Scripting
CVE-2024-13352HIGH
Legull <= 1.2.2 - Reflected XSS
36RISK
open ↗
Nucleimedium
Guten Free Options - Cross Site Scripting
CVE-2024-13492MEDIUM
Guten Free Options <= 0.9.5 - Reflected XSS
28RISK
open ↗
Nucleihigh
GamiPress <= 2.8.9 - SQL Injection
CVE-2024-13496HIGH
GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter
36RISK
open ↗
Nucleimedium
Zarinpal Paid Download - Reflected XSS
CVE-2024-13543MEDIUM
Zarinpal Paid Downloads <= 2.3 - Reflected XSS
28RISK
open ↗
Nucleihigh
WordPress Front End Users - Reflected XSS
CVE-2024-13569HIGH
Front End Users <= 3.2.32 - Reflected XSS
36RISK
open ↗
← previouspage 78 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.