Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,634cataloged exploits

40,286CVEs with public exploitation

24,696lab-tested

All Referência 26,110Exploit-DB 24,488GitHub PoC 17,941VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecent popular risk

24,488 exploits

Exploit-DB✓ VexDay Proof

Apache Sling Framework (Adobe AEM) 2.3.6 - Information Disclosure

CVE-2016-0956—webappsmultiple10 Feb 2016

The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows r

35RISK

Exploit-DB

Yeager CMS 1.2.1 - Multiple Vulnerabilities

CVE-2015-7571—webappsphp10 Feb 2016

Unrestricted file upload vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary code by uploadin

23RISK

Exploit-DB

Yeager CMS 1.2.1 - Multiple Vulnerabilities

CVE-2015-7572—webappsphp10 Feb 2016

20RISK

Exploit-DB

Yeager CMS 1.2.1 - Multiple Vulnerabilities

CVE-2015-7570—webappsphp10 Feb 2016

Multiple server-side request forgery (SSRF) vulnerabilities in Yeager CMS 1.2.1 allow remote attackers to trigger outbou

23RISK

Exploit-DB

Yeager CMS 1.2.1 - Multiple Vulnerabilities

CVE-2015-7568—webappsphp10 Feb 2016

SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the a

23RISK

Exploit-DB

Yeager CMS 1.2.1 - Multiple Vulnerabilities

CVE-2015-7567—webappsphp10 Feb 2016

SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passw

23RISK

Exploit-DB

Yeager CMS 1.2.1 - Multiple Vulnerabilities

CVE-2015-7569—webappsphp10 Feb 2016

SQL injection vulnerability in "yeager/y.php/tab_USERLIST" in Yeager CMS 1.2.1 allows local users to execute arbitrary S

23RISK

Exploit-DB✓ VexDay Proof

Microsoft Windows 7 SP1 (x86) - 'WebDAV' Local Privilege Escalation (MS16-016) (1)

CVE-2016-0051—localwindows_x8610 Feb 2016

The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Window

43RISK

Exploit-DB✓ VexDay Proof

Adobe Photoshop CC / Bridge CC - '.iff' Parsing Memory Corruption

CVE-2016-0953—doswindows09 Feb 2016

Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to exec

28RISK

Exploit-DB✓ VexDay Proof

Adobe Photoshop CC / Bridge CC - '.png' Parsing Memory Corruption (2)

CVE-2016-0952—doswindows09 Feb 2016

Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to exec

28RISK

Exploit-DB✓ VexDay Proof

Adobe Photoshop CC / Bridge CC - '.png' Parsing Memory Corruption (1)

CVE-2016-0951—doswindows09 Feb 2016

Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to exec

28RISK

Exploit-DB

Netgear NMS300 ProSafe Network Management System - Multiple Vulnerabilities

CVE-2016-1524—webappshardware04 Feb 2016

Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote

60RISK

Exploit-DB

D-Link DVGN5402SP - Multiple Vulnerabilities

CVE-2015-7247—webappshardware04 Feb 2016

D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and

28RISK

Exploit-DB✓ VexDay Proof

GE Industrial Solutions UPS SNMP Adapter < 4.8 - Multiple Vulnerabilities

CVE-2016-0862—webappshardware04 Feb 2016

General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authentica

23RISK

Exploit-DB

Netgear NMS300 ProSafe Network Management System - Multiple Vulnerabilities

CVE-2016-1525—webappshardware04 Feb 2016

Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allow

60RISK

Exploit-DB✓ VexDay Proof

GE Industrial Solutions UPS SNMP Adapter < 4.8 - Multiple Vulnerabilities

CVE-2016-0861—webappshardware04 Feb 2016

General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authentica

28RISK

Exploit-DB

D-Link DVGN5402SP - Multiple Vulnerabilities

CVE-2015-7246—webappshardware04 Feb 2016

D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root accou

28RISK

Exploit-DB

D-Link DVGN5402SP - Multiple Vulnerabilities

CVE-2015-7245—webappshardware04 Feb 2016

Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remot

50RISK

Exploit-DB

Viprinet Multichannel VPN Router 300 - Persistent Cross-Site Scripting

CVE-2014-2045—webappshardware03 Feb 2016

Multiple cross-site scripting (XSS) vulnerabilities in the old and new interfaces in Viprinet Multichannel VPN Router 30

23RISK

Exploit-DB

eClinicalWorks (CCMR) - Multiple Vulnerabilities

CVE-2015-4591—webappsjsp02 Feb 2016

eClinicalWorks Population Health (CCMR) suffers from a cross site scripting vulnerability in login.jsp which allows remo

23RISK

Exploit-DB

eClinicalWorks (CCMR) - Multiple Vulnerabilities

CVE-2015-4594—webappsjsp02 Feb 2016

eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the a

23RISK

Exploit-DB

eClinicalWorks (CCMR) - Multiple Vulnerabilities

CVE-2015-4592—webappsjsp02 Feb 2016

eClinicalWorks Population Health (CCMR) suffers from an SQL injection vulnerability in portalUserService.jsp which allow

23RISK

Exploit-DB

eClinicalWorks (CCMR) - Multiple Vulnerabilities

CVE-2015-4593—webappsjsp02 Feb 2016

eClinicalWorks Population Health (CCMR) suffers from a cross-site request forgery (CSRF) vulnerability in portalUserServ

23RISK

Exploit-DB

Microsoft Internet Explorer 11 - javascript Code Execution

CVE-2015-2419HIGHunder attacklocalwindows01 Feb 2016

JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial o

83RISK

Exploit-DB✓ VexDay Proof

Apple Mac OSX / iOS - Multiple Kernel Uninitialized Variable Bugs Leading to Code Execution Vulnerabilities

CVE-2016-1721—dosmultiple28 Jan 2016

The kernel in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges o

23RISK

Exploit-DB✓ VexDay Proof

Apple Mac OSX - OSMetaClassBase::safeMetaCast in IOAccelContext2::connectClient NULL Dereference

CVE-2015-6996—dososx28 Jan 2016

IOAcceleratorFamily in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute a

23RISK

Exploit-DB✓ VexDay Proof

Apple Mac OSX / iOS Kernel - IOHDIXControllUserClient::clientClose Use-After-Free/Double-Free

CVE-2015-7110—dosmultiple28 Jan 2016

The Disk Images component in Apple OS X before 10.11.2 and tvOS before 9.1 allows local users to gain privileges or caus

23RISK

Exploit-DB✓ VexDay Proof

Apple Mac OSX Kernel - Hypervisor Driver Use-After-Free

CVE-2015-7078—dososx28 Jan 2016

Use-after-free vulnerability in Hypervisor in Apple OS X before 10.11.2 allows local users to gain privileges via vector

23RISK

Exploit-DB✓ VexDay Proof

Apple Mac OSX / iOS - Double-Delete IOHIDEventQueue::start Code Execution

CVE-2015-7112—dosmultiple28 Jan 2016

The IOHIDFamily API in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attacke

23RISK

Exploit-DB✓ VexDay Proof

Apple Mac OSX Kernel - IOAccelMemoryInfoUserClient Use-After-Free

CVE-2015-7047—dososx28 Jan 2016

The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to g

23RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.