Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,836cataloged exploits

32,133CVEs with public exploitation

1,932lab-tested

All Exploit-DB 22,786Referência 19,967GitHub PoC 13,264VulnCheck XDB 8,156Nuclei 4,201Metasploit 3,462✓ verified onlyrecent popular risk

4,201 exploits

Nucleimedium

WordPress 1 Click Migration Plugin < 2.3 - Information Exposure

CVE-2024-13609MEDIUM

1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.php

28RISK

Nucleimedium

LifterLMS < 8.0.1 - Cross-Site Scripting

CVE-2024-13619MEDIUM

LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS

28RISK

Nucleihigh

WordPress WPMovieLibrary Plugin <= 2.1.4.8 - Cross-Site Scripting

CVE-2024-13624HIGH

WPMovieLibrary <= 2.1.4.8 - Reflected XSS

36RISK

Nucleihigh

Tube Video Ads Lite - Reflected XSS

CVE-2024-13625HIGH

Tube Video Ads Lite <= 1.5.7 - Reflected XSS

36RISK

Nucleimedium

OWL Carousel Slider - Cross-Site Scripting

CVE-2024-13627MEDIUM

WP Touch Slider <= 2.2 - Reflected XSS

28RISK

Nucleimedium

WP Pricing Table - Reflected XSS

CVE-2024-13628MEDIUM

WP Pricing Table <= 1.1 - Reflected XSS

28RISK

Nucleimedium

NewsTicker <= 1.0 - Reflected Cross-Site Scripting

CVE-2024-13630MEDIUM

News List <= 1.0 - Reflected XSS

28RISK

Nucleimedium

Post Sync Plugin <= 1.1 - Cross-Site Scripting

CVE-2024-13634MEDIUM

Post Sync <= 1.1 - Reflected XSS

28RISK

Nucleihigh

Themes Coder Ecommerce <= 1.3.4 - SQL Injection

CVE-2024-13726HIGH

Themes Coder <= 1.3.4 - Unauthenticated SQLi

36RISK

Nucleimedium

MemberSpace WordPress - Cross-Site Scripting

CVE-2024-13727MEDIUM

MemberSpace – Membership Plugin and Paid Subscriptions < 2.1.14 - Reflected XSS

28RISK

Nucleimedium

Relevanssi (A Better Search) <= 4.22.0 - Query Log Export

CVE-2024-1380MEDIUM

Relevanssi – A Better Search <= 4.22.0 (Free) and <= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log Export

40RISK

Nucleimedium

WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scripting

CVE-2024-13853MEDIUM

SEO Tools <= 4.0.7 - Reflected XSS

28RISK

Nucleihigh

WPMobile.App <= 11.56 - Open Redirect

CVE-2024-13888HIGH

WPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameter

36RISK

Nucleicritical

St. Joe ERP system - SQL Injection

CVE-2024-13979CRITICAL

St. Joe ERP System SingleRowQueryConverter SQL Injection

63RISK

Nucleimedium

Studiocart <= 2.9.0 - Cross-Site Scripting

CVE-2024-14015HIGH

Studiocart <= 2.9.0 - Reflected XSS

36RISK

Nucleihigh

Mlflow < 2.9.2 - Path Traversal

CVE-2024-1483HIGH

Path Traversal Vulnerability in mlflow/mlflow

36RISK

Nucleicritical

MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection

CVE-2024-1512CRITICAL

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection

85RISK

Nucleihigh

Gradio 4.3-4.12 - Local File Read

CVE-2024-1561HIGH

Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio

56RISK

Nucleicritical

NotificationX <= 2.8.2 - SQL Injection

CVE-2024-1698CRITICAL

NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection

85RISK

Nucleicritical

ConnectWise ScreenConnect 23.9.7 - Authentication Bypass

CVE-2024-1709CRITICALunder attackransomware

Authentication bypass using an alternate path or channel

100RISK

Nucleihigh

Gradio > 4.19.1 UploadButton - Path Traversal

CVE-2024-1728HIGH

Local File Inclusion in gradio-app/gradio

58RISK

Nucleihigh

Tutor LMS <= 2.1.10 - SQL Injection

CVE-2024-1751HIGH

Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection

36RISK

Nucleimedium

Cisco Finesse - Server-Side Request Forgery (SSRF)

CVE-2024-20404HIGH

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker t

61RISK

Nucleicritical

Cisco SSM On-Prem <= 8-202206 - Password Reset Account Takeover

CVE-2024-20419CRITICAL

A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauth

85RISK

Nucleicritical

Hardcoded Admin Credentials For Cisco Smart Licensing Utility API

CVE-2024-20439CRITICALunder attack

A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an a

95RISK

Nucleihigh

Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials

CVE-2024-20440HIGH

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive inf

48RISK

Nucleihigh

Artica Proxy - Unauthenticated LFI

CVE-2024-2053HIGH

Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability

68RISK

Nucleihigh

Adobe ColdFusion - Arbitrary File Read

CVE-2024-20767HIGHunder attack

ColdFusion | Improper Access Control (CWE-284)

100RISK

Nucleihigh

Oracle Retail Xstore Suite - Pre-authenticated Path Traversal

CVE-2024-21136HIGH

Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security). Supported

36RISK

Nucleimedium

Dash Framework - Cross-site Scripting

CVE-2024-21485MEDIUM

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; v

28RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.