Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,836cataloged exploits
32,133CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 19,967GitHub PoC 13,264VulnCheck XDB 8,156Nuclei 4,201Metasploit 3,462✓ verified onlyrecentpopularrisk
4,201 exploits
Nucleihigh
WordPress Clean Login <= 1.14.5 Authenticated (Contributor+) - Local File Inclusion
CVE-2024-8252HIGH
Clean Login <= 1.14.5 - Authenticated (Contributor+) Local File Inclusion
36RISK
open ↗
Nucleicritical
GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection
CVE-2024-8353CRITICAL
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection
68RISK
open ↗
Nucleicritical
WooCommerce Ultimate Gift Card ≤ 2.6.0 - Arbitrary File Upload
CVE-2024-8425CRITICAL
WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload
63RISK
open ↗
Nucleihigh
REST API TO MiniProgram <= 4.7.1 - SQL Injection
CVE-2024-8484HIGH
REST API TO MiniProgram <= 4.7.1 - Unauthenticated SQL Injection
36RISK
open ↗
Nucleicritical
VICIdial - SQL Injection
CVE-2024-8503CRITICAL
VICIdial Unauthenticated SQL Injection
85RISK
open ↗
Nucleicritical
SPIP BigUp Plugin - Remote Code Execution
CVE-2024-8517CRITICAL
SPIP Bigup Multipart File Upload OS Command Injection
85RISK
open ↗
Nucleicritical
LearnPress < 4.2.7.1 - SQL Injection
CVE-2024-8522CRITICAL
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'
75RISK
open ↗
Nucleicritical
LearnPress < 4.2.7.1 - SQL Injection
CVE-2024-8529CRITICAL
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'
68RISK
open ↗
Nucleicritical
Ivanti Connect Secure - Stack-based Buffer Overflow
CVE-2025-0282CRITICALunder attackransomware
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7
100RISK
open ↗
Nucleicritical
Elber ESE DVB-S/S2 - Authentication Bypass
CVE-2025-0674CRITICAL
Elber Communications Equipment Authentication Bypass Using an Alternate Path or Channel
43RISK
open ↗
Nucleicritical
DocsGPT - Unauthenticated Remote Code Execution
CVE-2025-0868CRITICAL
Remote Code Execution in DocsGPT
68RISK
open ↗
Nucleicritical
GoAnywhere - Authentication Bypass
CVE-2025-10035CRITICALunder attackransomware
Deserialization Vulnerability in GoAnywhere MFT's License Servlet
100RISK
open ↗
Nucleihigh
Jinher OA - SQL Injection
CVE-2025-10090MEDIUM
Jinher OA GetTreeDate.aspx sql injection
28RISK
open ↗
Nucleihigh
WordPress OrderConvo < 14 - Path Traversal
CVE-2025-10162HIGH
OrderConvo < 14 - Unauthenticated Arbitrary File Read
56RISK
open ↗
Nucleihigh
AC Smart II - Authentication Bypass
CVE-2025-10204HIGH
Unauth Admin Reset Password on AC Smart II
36RISK
open ↗
Nucleimedium
ChanCMS <= 3.3.0 - SQL Injection
CVE-2025-10210MEDIUM
yanyutao0402 ChanCMS Api.js search sql injection
28RISK
open ↗
Nucleimedium
ChanCMS <= 3.3.0 - Server-Side Request Forgery
CVE-2025-10211MEDIUM
yanyutao0402 ChanCMS getArticle CollectController server-side request forgery
28RISK
open ↗
Nucleicritical
ChurchCRM - SQL Injection
CVE-2025-1023CRITICAL
SQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.php
43RISK
open ↗
Nucleihigh
Cockpit < 2.4.1 - Arbitrary File Upload
CVE-2025-1025HIGH
Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can us
41RISK
open ↗
Nucleimedium
KLog Server - Path Traversal
CVE-2025-1035MEDIUM
Path Traversal in Komtera Technolgies' KLog Server
28RISK
open ↗
Nucleicritical
Melis Technology Melis Platform - Unrestricted File Upload & Remote Code Execution
CVE-2025-10353CRITICAL
Missing Authorization vulnerability in Melis Platform
63RISK
open ↗
Nucleihigh
WooCommerce Designer Pro <= 1.9.28 - Arbitrary File Read
CVE-2025-10897HIGH
WooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File Read
36RISK
open ↗
Nucleihigh
Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation
CVE-2025-1097HIGH
ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation
68RISK
open ↗
Nucleihigh
Ingress-Nginx Controller - Configuration Injection via Unsanitized Mirror Annotations
CVE-2025-1098HIGH
ingress-nginx controller - configuration injection via unsanitized mirror annotations
78RISK
open ↗
Nucleihigh
WP Google Maps < 9.0.48 - Cross-Site Scripting
CVE-2025-11307HIGH
WP Google Maps < 9.0.48 - Unauthenticated Stored XSS
36RISK
open ↗
Nucleimedium
LearnPress < 4.3.0 - Arbitrary Callback Execution to Information Exposure
CVE-2025-11368MEDIUM
LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure
28RISK
open ↗
Nucleimedium
Gladinet CentreStack & TrioFox - Local File Inclusion
CVE-2025-11371HIGHunder attack
Gladinet CentreStack and TrioFox Local File Inclusion Flaw
100RISK
open ↗
Nucleimedium
PowerJob List - Authorization Bypass
CVE-2025-11580MEDIUM
PowerJob list authorization
28RISK
open ↗
Nucleicritical
Export WP Page to Static HTML <= 4.3.4 - Cookie Exposure
CVE-2025-11693CRITICAL
Export WP Page to Static HTML & PDF <= 4.3.4 - Unauthenticated Cookie Exposure via Log File
43RISK
open ↗
Nucleihigh
N-central - XML External Entities Injection
CVE-2025-11700HIGH
N-central Multiple XXE Injection Vulnerabilities
68RISK
open ↗
← previouspage 84 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.