Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,679cataloged exploits
40,329CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
Dell Netvault Backup 10.0.1.24 - Denial of Service
CVE-2015-5696—doswindows07 Aug 2015
Dell Netvault Backup before 10.0.5 allows remote attackers to cause a denial of service (crash) via a crafted request.
23RISK
open ↗
Exploit-DB
Microsoft Windows XP SP3 (x86) / 2003 SP2 (x86) - 'NDProxy' Local Privilege Escalation (MS14-002)
CVE-2013-5065HIGHunder attacklocalwindows_x8607 Aug 2015
NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges
98RISK
open ↗
Exploit-DB
ISC BIND 9 - TKEY Remote Denial of Service (PoC)
CVE-2015-5477HIGHunder attackdosmultiple05 Aug 2015
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (
100RISK
open ↗
Exploit-DB
Linux Kernel - 'espfix64' Nested NMIs Interrupting Privilege Escalation
CVE-2015-3290—locallinux_x86-6405 Aug 2015
arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during n
23RISK
open ↗
Exploit-DB✓ VexDay Proof
ISC BIND 9 - TKEY (PoC)
CVE-2015-5477HIGHunder attackdosmultiple01 Aug 2015
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (
100RISK
open ↗
Exploit-DB✓ VexDay Proof
Sudo 1.8.14 (RHEL 5/6/7 / Ubuntu) - 'Sudoedit' Unauthorized Privilege Escalation
CVE-2015-5602—locallinux28 Jul 2015
sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is d
23RISK
open ↗
Exploit-DB
WordPress Plugin Count Per Day 3.4 - SQL Injection
CVE-2015-5533—webappsphp27 Jul 2015
SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote
23RISK
open ↗
Exploit-DB
Xceedium Xsuite - Multiple Vulnerabilities
CVE-2015-4665—webappsphp27 Jul 2015
Cross-site scripting (XSS) vulnerability in ajax_cmd.php in Xceedium Xsuite 2.4.4.1 and earlier allows remote attackers
23RISK
open ↗
Exploit-DB
Xceedium Xsuite - Multiple Vulnerabilities
CVE-2015-4666—webappsphp27 Jul 2015
Directory traversal vulnerability in opm/read_sessionlog.php in Xceedium Xsuite 2.4.4.5 and earlier allows remote attack
43RISK
open ↗
Exploit-DB✓ VexDay Proof
Libuser Library - Multiple Vulnerabilities
CVE-2015-3245—doslinux27 Jul 2015
Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in t
38RISK
open ↗
Exploit-DB
Xceedium Xsuite - Multiple Vulnerabilities
CVE-2015-4667—webappsphp27 Jul 2015
Multiple hardcoded credentials in Xsuite 2.x.
28RISK
open ↗
Exploit-DB
Xceedium Xsuite - Multiple Vulnerabilities
CVE-2015-4669—webappsphp27 Jul 2015
The MySQL "root" user in Xsuite 2.x does not have a password set, which allows local users to access databases on the sy
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Libuser Library - Multiple Vulnerabilities
CVE-2015-3246HIGHunder attackdoslinux27 Jul 2015
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly mod
86RISK
open ↗
Exploit-DB
Xceedium Xsuite - Multiple Vulnerabilities
CVE-2015-4668—webappsphp27 Jul 2015
Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sit
38RISK
open ↗
Exploit-DB
Xceedium Xsuite - Multiple Vulnerabilities
CVE-2015-4664—webappsphp27 Jul 2015
An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers t
28RISK
open ↗
Exploit-DB
Hawkeye-G 3.0.1.4912 - Cross-Site Request Forgery
CVE-2015-2878—webappsmultiple24 Jul 2015
Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijac
23RISK
open ↗
Exploit-DB
Internet Download Manager - OLE Automation Array Remote Code Execution
CVE-2014-6332HIGHunder attackremotewindows21 Jul 2015
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISK
open ↗
Exploit-DB
Joomla! Component Helpdesk Pro < 1.4.0 - Multiple Vulnerabilities
CVE-2015-4072—webappsphp21 Jul 2015
Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote att
23RISK
open ↗
Exploit-DB
Joomla! Component Helpdesk Pro < 1.4.0 - Multiple Vulnerabilities
CVE-2015-4071—webappsphp21 Jul 2015
The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users
23RISK
open ↗
Exploit-DB
Joomla! Component Helpdesk Pro < 1.4.0 - Multiple Vulnerabilities
CVE-2015-4075—webappsphp21 Jul 2015
The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted
23RISK
open ↗
Exploit-DB✓ VexDay Proof
SysAid Help Desk 'rdslogs' - Arbitrary File Upload (Metasploit)
CVE-2015-2995—remotejava21 Jul 2015
The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote at
50RISK
open ↗
Exploit-DB
XPCOM - Race Condition
CVE-2005-2414—webappsphp21 Jul 2015
Race condition in the xpcom library, as used by web browsers such as Firefox, Mozilla, Netscape, and Galeon, allows remo
23RISK
open ↗
Exploit-DB
Joomla! Component Helpdesk Pro < 1.4.0 - Multiple Vulnerabilities
CVE-2015-4074—webappsphp21 Jul 2015
Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read ar
50RISK
open ↗
Exploit-DB
Joomla! Component Helpdesk Pro < 1.4.0 - Multiple Vulnerabilities
CVE-2015-4073—webappsphp21 Jul 2015
Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to exe
23RISK
open ↗
Exploit-DB
TcpDump - rpki_rtr_pdu_print Out-of-Bounds Denial of Service
CVE-2015-2153—doslinux20 Jul 2015
The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers t
28RISK
open ↗
Exploit-DB
Microsoft Word - Local Machine Zone Code Execution (MS15-022)
CVE-2015-0097—localwindows20 Jul 2015
Microsoft Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Excel 2010 SP2, PowerPoint 2010 SP2, and Word 2010 SP2 all
35RISK
open ↗
Exploit-DB
Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (1)
CVE-2015-2863—webappswindows15 Jul 2015
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
43RISK
open ↗
Exploit-DB
Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (1)
CVE-2015-2862—webappswindows15 Jul 2015
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18,
23RISK
open ↗
Exploit-DB
Pimcore CMS Build 3450 - Directory Traversal
CVE-2015-4425—webappsxml14 Jul 2015
Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permi
23RISK
open ↗
Exploit-DB
SquirrelMail < 1.4.5-RC1 - Arbitrary Variable Overwrite
CVE-2005-2095—webappsphp14 Jul 2015
options_identities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the $_POST variable, which
23RISK
open ↗
← previouspage 190 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.