Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,445cataloged exploits

34,432CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,497GitHub PoC 13,627VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecent popular risk

24,443 exploits

Exploit-DB

Hawkeye-G 3.0.1.4912 - Cross-Site Request Forgery

CVE-2015-2878—webappsmultiple24 Jul 2015

Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijac

23RISK

open ↗

Exploit-DB

Joomla! Component Helpdesk Pro < 1.4.0 - Multiple Vulnerabilities

CVE-2015-4071—webappsphp21 Jul 2015

The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users

23RISK

open ↗

Exploit-DB

Joomla! Component Helpdesk Pro < 1.4.0 - Multiple Vulnerabilities

CVE-2015-4072—webappsphp21 Jul 2015

Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote att

23RISK

open ↗

Exploit-DB

Joomla! Component Helpdesk Pro < 1.4.0 - Multiple Vulnerabilities

CVE-2015-4073—webappsphp21 Jul 2015

Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to exe

23RISK

open ↗

Exploit-DB

Joomla! Component Helpdesk Pro < 1.4.0 - Multiple Vulnerabilities

CVE-2015-4074—webappsphp21 Jul 2015

Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read ar

50RISK

open ↗

Exploit-DB

Internet Download Manager - OLE Automation Array Remote Code Execution

CVE-2014-6332HIGHunder attackremotewindows21 Jul 2015

OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows

100RISK

open ↗

Exploit-DB

XPCOM - Race Condition

CVE-2005-2414—webappsphp21 Jul 2015

Race condition in the xpcom library, as used by web browsers such as Firefox, Mozilla, Netscape, and Galeon, allows remo

23RISK

open ↗

Exploit-DB✓ VexDay Proof

SysAid Help Desk 'rdslogs' - Arbitrary File Upload (Metasploit)

CVE-2015-2995—remotejava21 Jul 2015

The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote at

50RISK

open ↗

Exploit-DB

Joomla! Component Helpdesk Pro < 1.4.0 - Multiple Vulnerabilities

CVE-2015-4075—webappsphp21 Jul 2015

The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted

23RISK

open ↗

Exploit-DB

TcpDump - rpki_rtr_pdu_print Out-of-Bounds Denial of Service

CVE-2015-2153—doslinux20 Jul 2015

The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers t

28RISK

open ↗

Exploit-DB

Microsoft Word - Local Machine Zone Code Execution (MS15-022)

CVE-2015-0097—localwindows20 Jul 2015

Microsoft Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Excel 2010 SP2, PowerPoint 2010 SP2, and Word 2010 SP2 all

35RISK

open ↗

Exploit-DB

Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (1)

CVE-2015-2862—webappswindows15 Jul 2015

Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18,

23RISK

open ↗

Exploit-DB

Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (1)

CVE-2015-2863—webappswindows15 Jul 2015

Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b

43RISK

open ↗

Exploit-DB

sysPass 1.0.9 - SQL Injection

CVE-2015-6516—webappsphp14 Jul 2015

SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitra

23RISK

open ↗

Exploit-DB

Pimcore CMS Build 3450 - Directory Traversal

CVE-2015-4425—webappsxml14 Jul 2015

Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permi

23RISK

open ↗

Exploit-DB

SquirrelMail < 1.4.5-RC1 - Arbitrary Variable Overwrite

CVE-2005-2095—webappsphp14 Jul 2015

options_identities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the $_POST variable, which

23RISK

open ↗

Exploit-DB

ZenPhoto 1.4.8 - Multiple Vulnerabilities

CVE-2015-5595—webappsphp13 Jul 2015

Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack

23RISK

open ↗

Exploit-DB

Arab Portal 3 - SQL Injection

CVE-2015-6519—webappsphp13 Jul 2015

SQL injection vulnerability in Arab Portal 3 allows remote attackers to execute arbitrary SQL commands via the showemail

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Western Digital Arkeia < 11.0.12 - Remote Code Execution (Metasploit)

CVE-2015-7709—remotemultiple13 Jul 2015

The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to b

60RISK

open ↗

Exploit-DB

ZenPhoto 1.4.8 - Multiple Vulnerabilities

CVE-2015-5594—webappsphp13 Jul 2015

The sanitize_string function in ZenPhoto before 1.4.9 utilized the html_entity_decode function after input sanitation, w

23RISK

open ↗

Exploit-DB

SO Planning 1.32 - Multiple Vulnerabilities

CVE-2014-8674—webappsphp13 Jul 2015

Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the doc

23RISK

open ↗

Exploit-DB

FreiChat 9.6 - SQL Injection

CVE-2015-6512—webappsphp13 Jul 2015

SQL injection vulnerability in the get_messages function in server/plugins/chatroom/chatroom.php in FreiChat 9.6 allows

23RISK

open ↗

Exploit-DB

SO Planning 1.32 - Multiple Vulnerabilities

CVE-2014-8677—webappsphp13 Jul 2015

The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and

23RISK

open ↗

Exploit-DB

ArticleFR 3.0.6 - Multiple Vulnerabilities

CVE-2015-5530—webappsphp13 Jul 2015

Multiple cross-site request forgery (CSRF) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers t

23RISK

open ↗

Exploit-DB

SO Planning 1.32 - Multiple Vulnerabilities

CVE-2014-8676—webappsphp13 Jul 2015

Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attacke

50RISK

open ↗

Exploit-DB✓ VexDay Proof

Adobe Flash - opaqueBackground Use-After-Free (Metasploit)

CVE-2015-5122HIGHunder attackremotewindows13 Jul 2015

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player

100RISK

open ↗

Exploit-DB✓ VexDay Proof

WordPress Plugin Swim Team 1.44.10777 - Arbitrary File Download

CVE-2015-5471—webappsphp13 Jul 2015

Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allo

50RISK

open ↗

Exploit-DB

ArticleFR 3.0.6 - Multiple Vulnerabilities

CVE-2015-5529—webappsphp13 Jul 2015

Multiple cross-site scripting (XSS) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to injec

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Accellion FTA - getStatus verify_oauth_token Command Execution (Metasploit)

CVE-2015-2857—remotehardware13 Jul 2015

Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metach

60RISK

open ↗

Exploit-DB

ZenPhoto 1.4.8 - Multiple Vulnerabilities

CVE-2015-5591—webappsphp13 Jul 2015

SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands.

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.