Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
71,836cataloged exploits
32,133CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 19,967GitHub PoC 13,264VulnCheck XDB 8,156Nuclei 4,201Metasploit 3,462✓ verified onlyrecentpopularrisk
4,201 exploits
Nucleihigh
SiYuan <= v3.6.1 - Path Traversal
SiYuan has an Unauthenticated Arbitrary File Read via Path Traversal
36RISK
open ↗Nucleicritical
AVideo <= 26.0 - WWBN AVideo - Remote Code Execution
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
48RISK
open ↗Nucleihigh
Langflow < 1.7.0 - Path Traversal
Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading
36RISK
open ↗Nucleimedium
EspoCRM <= 9.3.3 - Server-Side Request Forgery
EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation
48RISK
open ↗Nucleihigh
LMDeploy - Server-Side Request Forgery
LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
68RISK
open ↗Nucleimedium
Mastodon - Open Redirect
Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'
28RISK
open ↗Nucleihigh
WCAPF WooCommerce Ajax Product Filter - SQL Injection
WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection
36RISK
open ↗Nucleicritical
LiteLLM - Command Injection
LiteLLM: Authenticated command execution via MCP stdio test endpoints
100RISK
open ↗Nucleicritical
MagicMirror <= 2.35.0 - Server-Side Request Forgery
MagicMirror²: Unauthenticated SSRF via /cors endpoint
43RISK
open ↗Nucleicritical
phpVMS < 7.0.6 - Legacy Importer Authorization Bypass
phpvms: /importer authorization bypass causing full database wipe
43RISK
open ↗Nucleicritical
WordPress Contact Form by Supsystic - Server-Side Template Injection
Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
75RISK
open ↗Nucleicritical
Gotenberg - Command Injection
Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection
63RISK
open ↗Nucleicritical
JoomSport <= 5.7.7 - SQL Injection
WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability
63RISK
open ↗Nucleicritical
Scramble Laravel - Remote Code Execution
Scramble: Remote code execution via evaluation of user-controlled input in validation rules
63RISK
open ↗Nucleicritical
Open WebUI 'LDAP Empty Password' - Authentication Bypass
Open WebUI: LDAP Empty Password Authentication Bypass
43RISK
open ↗Nucleihigh
Dozzle - Server Side Request Forgery
Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)
36RISK
open ↗Nucleimedium
Open WebUI < 0.9.5 - Information Disclosure
Open WebUI: Unauthenticated RAG Configuration Disclosure
28RISK
open ↗Nucleicritical
Cockpit Web Console < 360 - Remote Code Execution
Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection
68RISK
open ↗Nucleicritical
9Router <= 0.4.36 - Unauthenticated RCE
9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
43RISK
open ↗Nucleicritical
phpMyFAQ <= 4.1.1 - SQL Injection
phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha
43RISK
open ↗Nucleihigh
SillyTavern - Server-Side Request Forgery
SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl
36RISK
open ↗Nucleicritical
Flowise < 3.1.2 - node-custom-function Unauthorized RCE
Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape
63RISK
open ↗Nucleicritical
TYPO3 ceselector Extension - Insecure Deserialization
Remote Code Execution in extension "Content Element Selector" (ceselector)
43RISK
open ↗Nucleicritical
Google ADK-Python - Unauthenticated Builder Endpoint
Remote Code Execution in Google Agent Development Kit (ADK)
43RISK
open ↗Nucleicritical
Adobe ColdFusion - RDS Arbitrary File Write
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
68RISK
open ↗Nucleihigh
ColdFusion - Path Traversal
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
43RISK
open ↗Nucleicritical
phpBB < 3.3.17 - Authentication Bypass
Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or
63RISK
open ↗Nucleicritical
Starlette - Improper Validation of Unsafe Equivalence in Input
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
48RISK
open ↗Nucleicritical
Joomla! JCE extension < 2.9.99.5 unauthenticated RCE
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISK
open ↗Nucleicritical
WordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCE
WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability
63RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.