Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,679cataloged exploits
40,329CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
GeniXCMS 0.0.3 - 'register.php' SQL Injection
CVE-2015-3933—webappsphp24 Jun 2015
Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote
23RISK
open ↗
Exploit-DB
GeniXCMS 0.0.3 - Cross-Site Scripting
CVE-2015-5066—webappsphp24 Jun 2015
Multiple cross-site scripting (XSS) vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject ar
23RISK
open ↗
Exploit-DB
GeniXCMS 0.0.3 - Cross-Site Scripting
CVE-2015-3221—webappsphp24 Jun 2015
OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, a
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Photoshop CC2014 / Bridge CC 2014 - '.png' Parsing Memory Corruption
CVE-2015-3112—doswindows23 Jun 2015
Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allow attackers to execute arbitrary code
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Photoshop CC2014 / Bridge CC 2014 - '.gif' Parsing Memory Corruption
CVE-2015-3110—doswindows23 Jun 2015
Integer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to ex
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Photoshop CC2014 / Bridge CC 2014 - '.png' Parsing Memory Corruption
CVE-2015-3111—doswindows23 Jun 2015
Heap-based buffer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attac
28RISK
open ↗
Exploit-DB✓ VexDay Proof
CUPS < 2.0.3 - Multiple Vulnerabilities
CVE-2015-1158—remotemultiple22 Jun 2015
The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-va
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Tango DropBox 3.1.5 + PRO - Activex HeapSpray
CVE-2007-3071—webappswindows19 Jun 2015
Buffer overflow in the GetWebStoreURL function in a certain ActiveX control in eSellerateControl365.dll 3.6.5.0 in eSell
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Lively Cart - SQL Injection
CVE-2015-5148—webappsmultiple19 Jun 2015
SQL injection vulnerability in LivelyCart 1.2.0 allows remote attackers to execute arbitrary SQL commands via the search
23RISK
open ↗
Exploit-DB
ManageEngine SupportCenter Plus 7.90 - Multiple Vulnerabilities
CVE-2015-5149—webappsmultiple19 Jun 2015
Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to writ
28RISK
open ↗
Exploit-DB
ManageEngine SupportCenter Plus 7.90 - Multiple Vulnerabilities
CVE-2015-5150—webappsmultiple19 Jun 2015
Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authentica
23RISK
open ↗
Exploit-DB
BlackCat CMS 1.1.1 - Arbitrary File Download
CVE-2015-5079—webappsphp17 Jun 2015
Directory traversal vulnerability in widgets/logs.php in BlackCat CMS before 1.1.2 allows remote attackers to read arbit
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation
CVE-2015-1328—locallinux16 Jun 2015
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does no
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Ruby on Rails 4.0.x/4.1.x/4.2.x (Web Console v2) - Whitelist Bypass Code Execution (Metasploit)
CVE-2015-3224—remotemultiple16 Jun 2015
request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-
50RISK
open ↗
Exploit-DB
Ektron CMS 9.10 SP1 (Build 9.1.0.184.1.114) - Cross-Site Request Forgery
CVE-2015-3624—webappsphp16 Jun 2015
Cross-site request forgery (CSRF) vulnerability in Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx in Ektron Content
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation (Access /etc/shadow)
CVE-2015-1328—locallinux16 Jun 2015
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does no
50RISK
open ↗
Exploit-DB
TYPO3 Extension Akronymmanager 0.5.0 - SQL Injection
CVE-2015-2803—webappsphp16 Jun 2015
SQL injection vulnerability in mod1/index.php in the Akronymmanager (sb_akronymmanager) extension before 7.0.0 for TYPO3
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Milw0rm Clone Script 1.0 - '/admin/login.php' Authentication Bypass
CVE-2015-4658—webappsphp15 Jun 2015
Multiple SQL injection vulnerabilities in admin/login.php in Milw0rm Clone Script 1.0 allow remote attackers to execute
23RISK
open ↗
Exploit-DB✓ VexDay Proof
ZCMS 1.1 - Multiple Vulnerabilities
CVE-2015-7347—webappsjsp12 Jun 2015
Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin SE HTML5 Album Audio Player 1.1.0 - Directory Traversal
CVE-2015-4414—webappsphp12 Jun 2015
Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player)
43RISK
open ↗
Exploit-DB
WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload
CVE-2015-4455—webappsphp12 Jun 2015
Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin
50RISK
open ↗
Exploit-DB
Opsview 4.6.2 - Multiple Cross-Site Scripting Vulnerabilities
CVE-2015-4420—webappsmultiple12 Jun 2015
Multiple cross-site scripting (XSS) vulnerabilities in Opsview 4.6.2 and earlier allow remote attackers to inject arbitr
23RISK
open ↗
Exploit-DB✓ VexDay Proof
ZCMS 1.1 - Multiple Vulnerabilities
CVE-2015-7346—webappsjsp12 Jun 2015
SQL injection vulnerability in ZCMS 1.1.
23RISK
open ↗
Exploit-DB
ClickHeat 1.14 - Cross-Site Request Forgery (Change Admin Password)
CVE-2015-4659—webappsphp12 Jun 2015
Cross-site request forgery (CSRF) vulnerability in ClickHeat 1.14 and earlier allows remote attackers to hijack the auth
23RISK
open ↗
Exploit-DB
OSSEC 2.7 < 2.8.1 - 'diff' Local Privilege Escalation
CVE-2015-3222—locallinux11 Jun 2015
syscheck/seechanges.c in OSSEC 2.7 through 2.8.1 on NIX systems allows local users to execute arbitrary code as root.
23RISK
open ↗
Exploit-DB
SysAid Help Desk 14.4 - Multiple Vulnerabilities
CVE-2015-2994—webappshardware10 Jun 2015
Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators t
50RISK
open ↗
Exploit-DB
FiverrScript - Cross-Site Request Forgery (Add Admin)
CVE-2015-4677—webappsphp10 Jun 2015
Cross-site request forgery (CSRF) vulnerability in FiverrScript (aka Fiverr Script) 7.2 allows remote attackers to hijac
23RISK
open ↗
Exploit-DB
ICU library 52 < 54 - Multiple Vulnerabilities
CVE-2014-8146—localmultiple10 Jun 2015
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in I
28RISK
open ↗
Exploit-DB
HP WebInspect 10.4 - XML External Entity Injection
CVE-2015-2125—webappsxml10 Jun 2015
Unspecified vulnerability in HP WebInspect 7.x through 10.4 before 10.4 update 1 allows remote authenticated users to by
23RISK
open ↗
Exploit-DB
SysAid Help Desk 14.4 - Multiple Vulnerabilities
CVE-2015-2995—webappshardware10 Jun 2015
The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote at
50RISK
open ↗
← previouspage 193 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.