Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
19,067 exploits
Exploit-DB✓ VexDay Proof
KingView 6.53 - 'KChartXY' ActiveX File Creation / Overwrite
CVE-2013-6128—localwindows04 Sep 2013
The KCHARTXYLib.KChartXY ActiveX control in KChartXY.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 doe
23RISK
open ↗
Exploit-DB✓ VexDay Proof
GOMPlayer 2.2.53.5169 - '.wav' Crash (PoC)
CVE-2013-5716—doswindows04 Sep 2013
Gretech GOM Media Player 2.2.53.5169 and possibly earlier allows remote attackers to cause a denial of service (applicat
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer - CFlatMarkupPointer Use-After-Free (MS13-059) (Metasploit)
CVE-2013-3184—remotewindows04 Sep 2013
Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service
50RISK
open ↗
Exploit-DB✓ VexDay Proof
HP LoadRunner - lrFileIOService ActiveX WriteFileString Remote Code Execution (Metasploit)
CVE-2013-4798—remotewindows04 Sep 2013
Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown ve
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple Mac OSX 10.8.4 - Local Privilege Escalation
CVE-2013-1775—localosx30 Aug 2013
sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypas
38RISK
open ↗
Exploit-DB✓ VexDay Proof
AVTECH DVR Firmware 1017-1003-1009-1003 - Multiple Vulnerabilities
CVE-2013-4982—doshardware29 Aug 2013
AVTECH AVN801 DVR has a security bypass via the administration login captcha
43RISK
open ↗
Exploit-DB✓ VexDay Proof
HP LoadRunner - lrFileIOService ActiveX Remote Code Execution (Metasploit)
CVE-2013-2370—remotewindows29 Aug 2013
Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown ve
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Mozilla Firefox - XMLSerializer Use-After-Free (Metasploit)
CVE-2013-0753—remotewindows29 Aug 2013
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple Mac OSX - Sudo Password Bypass (Metasploit)
CVE-2013-1775—localosx29 Aug 2013
sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypas
38RISK
open ↗
Exploit-DB✓ VexDay Proof
AVTECH DVR Firmware 1017-1003-1009-1003 - Multiple Vulnerabilities
CVE-2013-4980—doshardware29 Aug 2013
Buffer overflow in the RTSP Packet Handler in AVTECH AVN801 DVR with firmware 1017-1003-1009-1003 and earlier, and possi
23RISK
open ↗
Exploit-DB✓ VexDay Proof
AVTECH DVR Firmware 1017-1003-1009-1003 - Multiple Vulnerabilities
CVE-2013-4981—doshardware29 Aug 2013
Buffer overflow in cgi-bin/user/Config.cgi in AVTECH AVN801 DVR with firmware 1017-1003-1009-1003 and earlier, and possi
23RISK
open ↗
Exploit-DB✓ VexDay Proof
VMware - Setuid VMware-mount Unsafe popen(3) (Metasploit)
CVE-2013-1662—locallinux29 Aug 2013
vmware-mount in VMware Workstation 8.x and 9.x and VMware Player 4.x and 5.x, on systems based on Debian GNU/Linux, allo
38RISK
open ↗
Exploit-DB✓ VexDay Proof
Aloaha PDF Suite - Remote Stack Buffer Overflow
CVE-2013-4978—remotewindows28 Aug 2013
Stack-based buffer overflow in AloahaPDFViewer 5.0.0.7 and earlier in Aloaha PDF Suite FREE allows remote attackers to e
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Oracle Endeca Server - Remote Command Execution (Metasploit)
CVE-2013-3763—remotewindows26 Aug 2013
Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows rem
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Winamp 5.63 - 'winamp.ini' Local Overflow
CVE-2013-4694—localwindows26 Aug 2013
Stack-based buffer overflow in gen_jumpex.dll in Winamp before 5.64 Build 3418 allows remote attackers to cause a denial
28RISK
open ↗
Exploit-DB✓ VexDay Proof
cm3 Acora CMS - 'top.aspx' Information Disclosure
CVE-2013-4727—webappsphp26 Aug 2013
DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote at
23RISK
open ↗
Exploit-DB✓ VexDay Proof
SearchBlox - Multiple Information Disclosure Vulnerabilities
CVE-2013-3597—webappsjava23 Aug 2013
servlet/CollectionListServlet in SearchBlox before 7.5 build 1 allows remote attackers to read usernames and passwords v
23RISK
open ↗
Exploit-DB✓ VexDay Proof
VMware - Setuid VMware-mount Popen lsb_release Privilege Escalation
CVE-2013-1662—locallinux22 Aug 2013
vmware-mount in VMware Workstation 8.x and 9.x and VMware Player 4.x and 5.x, on systems based on Debian GNU/Linux, allo
38RISK
open ↗
Exploit-DB✓ VexDay Proof
Foreman (RedHat OpenStack/Satellite) - users/create Mass Assignment (Metasploit)
CVE-2013-2113—webappslinux22 Aug 2013
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
43RISK
open ↗
Exploit-DB✓ VexDay Proof
Ovidentia 7.9.4 - Multiple Vulnerabilities
CVE-2008-3918—webappsphp22 Aug 2013
SQL injection vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Ovidentia 7.9.4 - Multiple Vulnerabilities
CVE-2008-4423—webappsphp22 Aug 2013
SQL injection vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Twilight CMS - DeWeS Web Server Directory Traversal
CVE-2013-4900—webappsphp21 Aug 2013
Directory traversal vulnerability in DeWeS web server 0.4.2 and possibly earlier, as used in Twilight CMS, allows remote
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Graphite Web - Unsafe Pickle Handling (Metasploit)
CVE-2013-5093—remoteunix21 Aug 2013
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Xibo - Cross-Site Request Forgery
CVE-2013-4889—webappsphp21 Aug 2013
Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attac
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Xibo - 'layout' HTML Injection
CVE-2013-4888—webappsphp21 Aug 2013
Cross-site scripting (XSS) vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject ar
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PCMan FTP Server 2.07 - 'STOR' Remote Buffer Overflow
CVE-2013-4730—remotewindows19 Aug 2013
Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USE
50RISK
open ↗
Exploit-DB✓ VexDay Proof
VideoLAN VLC Media Player 2.0.8 - '.m3u' Local Crash (PoC)
CVE-2013-6283—doswindows19 Aug 2013
VideoLAN VLC Media Player 2.0.8 and earlier allows remote attackers to cause a denial of service (crash) and possibly ex
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Java - 'storeImageArray()' Invalid Array Indexing (Metasploit)
CVE-2013-2465CRITICALunder attackransomwareremotemultiple19 Aug 2013
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 U
100RISK
open ↗
Exploit-DB✓ VexDay Proof
AlgoSec Firewall Analyzer - Cross-Site Scripting
CVE-2013-5092—remotehardware16 Aug 2013
Cross-site scripting (XSS) vulnerability in afa/php/Login.php in AlgoSec Firewall Analyzer 6.1-b86 allows remote attacke
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Joomla! Component Media Manager - Arbitrary File Upload (Metasploit)
CVE-2013-5576—remotephp15 Aug 2013
administrator/components/com_media/helpers/media.php in the media manager in Joomla! 2.5.x before 2.5.14 and 3.x before
50RISK
open ↗
← previouspage 100 / 636next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.