Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,679cataloged exploits
40,329CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
Pimcore CMS Build 3450 - Directory Traversal
CVE-2015-4425—webappsxml14 Jul 2015
Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permi
23RISK
open ↗
Exploit-DB
ArticleFR 3.0.6 - Multiple Vulnerabilities
CVE-2015-5529—webappsphp13 Jul 2015
Multiple cross-site scripting (XSS) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to injec
23RISK
open ↗
Exploit-DB
ArticleFR 3.0.6 - Multiple Vulnerabilities
CVE-2015-5530—webappsphp13 Jul 2015
Multiple cross-site request forgery (CSRF) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers t
23RISK
open ↗
Exploit-DB
ZenPhoto 1.4.8 - Multiple Vulnerabilities
CVE-2015-5595—webappsphp13 Jul 2015
Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Adobe Flash - opaqueBackground Use-After-Free (Metasploit)
CVE-2015-5122HIGHunder attackremotewindows13 Jul 2015
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
100RISK
open ↗
Exploit-DB
Arab Portal 3 - SQL Injection
CVE-2015-6519—webappsphp13 Jul 2015
SQL injection vulnerability in Arab Portal 3 allows remote attackers to execute arbitrary SQL commands via the showemail
23RISK
open ↗
Exploit-DB
ZenPhoto 1.4.8 - Multiple Vulnerabilities
CVE-2015-5591—webappsphp13 Jul 2015
SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Western Digital Arkeia < 11.0.12 - Remote Code Execution (Metasploit)
CVE-2015-7709—remotemultiple13 Jul 2015
The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to b
60RISK
open ↗
Exploit-DB
ZenPhoto 1.4.8 - Multiple Vulnerabilities
CVE-2015-5594—webappsphp13 Jul 2015
The sanitize_string function in ZenPhoto before 1.4.9 utilized the html_entity_decode function after input sanitation, w
23RISK
open ↗
Exploit-DB
FreiChat 9.6 - SQL Injection
CVE-2015-6512—webappsphp13 Jul 2015
SQL injection vulnerability in the get_messages function in server/plugins/chatroom/chatroom.php in FreiChat 9.6 allows
23RISK
open ↗
Exploit-DB
SO Planning 1.32 - Multiple Vulnerabilities
CVE-2014-8673—webappsphp13 Jul 2015
Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in
28RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin Swim Team 1.44.10777 - Arbitrary File Download
CVE-2015-5471—webappsphp13 Jul 2015
Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allo
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Accellion FTA - getStatus verify_oauth_token Command Execution (Metasploit)
CVE-2015-2857—remotehardware13 Jul 2015
Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metach
60RISK
open ↗
Exploit-DB
SO Planning 1.32 - Multiple Vulnerabilities
CVE-2014-8676—webappsphp13 Jul 2015
Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attacke
50RISK
open ↗
Exploit-DB
SO Planning 1.32 - Multiple Vulnerabilities
CVE-2014-8677—webappsphp13 Jul 2015
The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and
23RISK
open ↗
Exploit-DB
SO Planning 1.32 - Multiple Vulnerabilities
CVE-2014-8675—webappsphp13 Jul 2015
Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which all
28RISK
open ↗
Exploit-DB
SO Planning 1.32 - Multiple Vulnerabilities
CVE-2014-8674—webappsphp13 Jul 2015
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the doc
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Adobe Flash Player - ByteArray Use-After-Free (Metasploit)
CVE-2015-5119HIGHunder attackremotemultiple08 Jul 2015
Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.
100RISK
open ↗
Exploit-DB✓ VexDay Proof
Adobe Flash Player - Nellymoser Audio Decoding Buffer Overflow (Metasploit)
CVE-2015-3113HIGHunder attackremotemultiple08 Jul 2015
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows an
100RISK
open ↗
Exploit-DB✓ VexDay Proof
AirLink101 SkyIPCam1620W - OS Command Injection
CVE-2015-2280—webappshardware08 Jul 2015
snwrite.cgi in AirLink101 SkyIPCam1620W Wireless N MPEG4 3GPP network camera with firmware FW_AIC1620W_1.1.0-12_20120709
28RISK
open ↗
Exploit-DB
Centreon 2.5.4 - Multiple Vulnerabilities
CVE-2015-1560—webappsphp08 Jul 2015
SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon (formerly Merethis
23RISK
open ↗
Exploit-DB
WordPress Plugin Easy2Map 1.24 - SQL Injection
CVE-2015-4614—webappsphp08 Jul 2015
Multiple SQL injection vulnerabilities in includes/Function.php in the Easy2Map plugin before 1.2.5 for WordPress allow
23RISK
open ↗
Exploit-DB
WordPress Plugin Easy2Map 1.24 - SQL Injection
CVE-2015-4616—webappsphp08 Jul 2015
Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allo
28RISK
open ↗
Exploit-DB
Orchard CMS 1.7.3/1.8.2/1.9.0 - Persistent Cross-Site Scripting
CVE-2015-5520—webappsasp08 Jul 2015
Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allow
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin WP E-Commerce Shop Styling 2.5 - Arbitrary File Download
CVE-2015-5468—webappsphp08 Jul 2015
Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attack
28RISK
open ↗
Exploit-DB✓ VexDay Proof
AirLive (Multiple Products) - OS Command Injection
CVE-2015-2279—webappshardware08 Jul 2015
cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Adobe Flash Player - Nellymoser Audio Decoding Buffer Overflow (Metasploit)
CVE-2015-3043HIGHunder attackremotemultiple08 Jul 2015
Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457
100RISK
open ↗
Exploit-DB
Centreon 2.5.4 - Multiple Vulnerabilities
CVE-2015-1561—webappsphp08 Jul 2015
The escape_command function in include/Administration/corePerformance/getStats.php in Centreon (formerly Merethis Centre
23RISK
open ↗
Exploit-DB
phpLiteAdmin 1.1 - Multiple Vulnerabilities
CVE-2015-6517—webappsphp07 Jul 2015
Cross-site request forgery (CSRF) vulnerability in phpLiteAdmin 1.1 allows remote attackers to hijack the authentication
23RISK
open ↗
Exploit-DB
phpLiteAdmin 1.1 - Multiple Vulnerabilities
CVE-2015-6518—webappsphp07 Jul 2015
Multiple cross-site scripting (XSS) vulnerabilities in phpLiteAdmin 1.1 allow remote attackers to inject arbitrary web s
23RISK
open ↗
← previouspage 191 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.