Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,836cataloged exploits

32,133CVEs with public exploitation

1,932lab-tested

All Exploit-DB 22,786Referência 19,967GitHub PoC 13,264VulnCheck XDB 8,156Nuclei 4,201Metasploit 3,462✓ verified onlyrecent popular risk

4,201 exploits

Nucleimedium

Trendnet AC2600 TEW-827DRU - Credentials Disclosure

CVE-2021-20150—

Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. Authe

30RISK

open ↗

Nucleicritical

Trendnet AC2600 TEW-827DRU 2.08B01 - Admin Password Change

CVE-2021-20158—

Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability. It is possible for an unauth

23RISK

open ↗

Nucleihigh

Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun

CVE-2021-20167—

Netgear RAX43 version 1.0.3.96 contains a command injection vulnerability. The readycloud cgi application is vulnerable

18RISK

open ↗

Nucleimedium

Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting

CVE-2021-20323—

A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.

30RISK

open ↗

Nucleicritical

Acmailer - Improper Access Control to OS Command Injection

CVE-2021-20617—

Improper access control vulnerability in acmailer ver. 4.0.1 and earlier, and acmailer DB ver. 1.1.3 and earlier allows

18RISK

open ↗

Nucleimedium

WordPress Quiz and Survey Master <7.1.14 - Cross-Site Scripting

CVE-2021-20792—

Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject

18RISK

open ↗

Nucleicritical

MovableType - Remote Command Injection

CVE-2021-20837—

Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movab

60RISK

open ↗

Nucleimedium

Adobe ColdFusion - Cross-Site Scripting

CVE-2021-21087MEDIUM

ColdFusion Improper neutralization of web input during page generation could lead to arbitrary JavaScript execution in the browser

40RISK

open ↗

Nucleihigh

Spring Boot Actuator Logview Directory Traversal

CVE-2021-21234HIGH

Directory Traversal

61RISK

open ↗

Nucleihigh

OneDev < 4.0.3 - User Access Token Leak

CVE-2021-21246HIGH

Pre-Auth Access token leak

48RISK

open ↗

Nucleihigh

MinIO Browser API - Server-Side Request Forgery

CVE-2021-21287HIGH

Server-Side Request Forgery in MinIO Browser API

41RISK

open ↗

Nucleicritical

Lucee Admin - Remote Code Execution

CVE-2021-21307HIGH

Remote Code Exploit in Lucee Admin

78RISK

open ↗

Nucleihigh

Adminer <4.7.9 - Server-Side Request Forgery

CVE-2021-21311HIGHunder attack

SSRF in adminer

100RISK

open ↗

Nucleihigh

Node.JS System Information Library <5.3.1 - Remote Command Injection

CVE-2021-21315HIGHunder attack

Command Injection Vulnerability

100RISK

open ↗

Nucleicritical

XStream < 1.4.16 - Remote Code Execution

CVE-2021-21345MEDIUM

XStream is vulnerable to a Remote Command Execution attack

50RISK

open ↗

Nucleicritical

Oracle WebLogic Server - Remote Code Execution

CVE-2021-2135CRITICAL

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Suppor

43RISK

open ↗

Nucleicritical

XStream <1.4.16 - Remote Code Execution

CVE-2021-21351MEDIUM

XStream is vulnerable to an Arbitrary Code Execution attack

50RISK

open ↗

Nucleihigh

BuddyPress REST API <7.2.1 - Privilege Escalation/Remote Code Execution

CVE-2021-21389HIGH

BuddyPress privilege escalation via REST API

61RISK

open ↗

Nucleimedium

Jellyfin <10.7.0 - Local File Inclusion

CVE-2021-21402HIGH

Unauthenticated Arbitrary File Access in Jellyfin

78RISK

open ↗

Nucleicritical

SCIMono <0.0.19 - Remote Code Execution

CVE-2021-21479HIGH

In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availabi

41RISK

open ↗

Nucleimedium

ZTE MF971R - Referer authentication bypass

CVE-2021-21745—

ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use th

30RISK

open ↗

Nucleimedium

Advantech R-SeeNet 2.4.12 - Cross-Site Scripting

CVE-2021-21799CRITICAL

Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (2

48RISK

open ↗

Nucleimedium

Advantech R-SeeNet 2.4.12 - Cross-Site Scripting

CVE-2021-21800CRITICAL

Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.1

48RISK

open ↗

Nucleimedium

Advantech R-SeeNet - Cross-Site Scripting

CVE-2021-21801CRITICAL

This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web application

55RISK

open ↗

Nucleimedium

Advantech R-SeeNet - Cross-Site Scripting

CVE-2021-21802CRITICAL

This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web application

43RISK

open ↗

Nucleicritical

WooCommerce Help Scout - Arbitrary File Upload

CVE-2021-24212—

WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE

18RISK

open ↗

Nucleimedium

GiveWP <= 2.9.7 - Cross-Site Scripting

CVE-2021-24213—

GiveWP < 2.10.0 - Reflected Cross Site Scripting (XSS)

18RISK

open ↗

Nucleimedium

WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting

CVE-2021-24214—

OpenID Connect Generic Client 3.8.0-3.8.1 - Reflected Cross Site Scripting (XSS) via Login Error

18RISK

open ↗

Nucleicritical

Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalation

CVE-2021-24215—

Controlled Admin Access < 1.5.2 - Improper Access Control & Privilege Escalation

18RISK

open ↗

Nucleimedium

All Thrive Themes and Plugins - Unauthenticated Option Update

CVE-2021-24219—

All Thrive Themes and Plugins - Unauthenticated Option Update

18RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.