Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,526cataloged exploits
34,478CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,534GitHub PoC 13,654VulnCheck XDB 8,213Nuclei 4,218Metasploit 3,464✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB
Lorex LH300 Series - ActiveX Buffer Overflow (PoC)
CVE-2014-1201—doshardware18 Jan 2015
Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows < 8.1 (x86/x64) - User Profile Service Privilege Escalation (MS15-003)
CVE-2015-0004—localwindows18 Jan 2015
The User Profile Service (aka ProfSvc) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2
23RISK
open ↗
Exploit-DB
WordPress Plugin Pie Register 2.0.13 - Privilege Escalation
CVE-2014-8802—webappsphp16 Jan 2015
The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-regist
23RISK
open ↗
Exploit-DB
Sim Editor 6.6 - Local Stack Buffer Overflow
CVE-2015-1171—localwindows16 Jan 2015
Stack-based buffer overflow in GSM SIM Utility (aka SIM Card Editor) 6.6 allows remote attackers to execute arbitrary co
50RISK
open ↗
Exploit-DB
ManageEngine Desktop Central - Create Administrator
CVE-2014-7862—webappsmultiple15 Jan 2015
The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote at
60RISK
open ↗
Exploit-DB
Ansible Tower 2.0.2 - Multiple Vulnerabilities
CVE-2015-1481—webappsmultiple14 Jan 2015
Ansible Tower (aka Ansible UI) before 2.0.5 allows remote organization administrators to gain privileges by creating a s
23RISK
open ↗
Exploit-DB
Ansible Tower 2.0.2 - Multiple Vulnerabilities
CVE-2015-1368—webappsmultiple14 Jan 2015
Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attacker
23RISK
open ↗
Exploit-DB
Ansible Tower 2.0.2 - Multiple Vulnerabilities
CVE-2015-1482—webappsmultiple14 Jan 2015
Ansible Tower (aka Ansible UI) before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive inform
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Oracle MySQL (Windows) - FILE Privilege Abuse (Metasploit)
CVE-2012-5613—remotewindows13 Jan 2015
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the
50RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin WP Symposium 14.11 - Arbitrary File Upload (Metasploit)
CVE-2014-10021—remotephp13 Jan 2015
Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote
50RISK
open ↗
Exploit-DB
Dell iDRAC IPMI 1.5 - Insufficient Session ID Randomness
CVE-2014-8272—webappshardware13 Jan 2015
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Lexmark MarkVision Enterprise - Arbitrary File Upload (Metasploit)
CVE-2014-8741—remotejava13 Jan 2015
Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allo
60RISK
open ↗
Exploit-DB
Gecko CMS 2.3 - Multiple Vulnerabilities
CVE-2015-1424—webappsphp13 Jan 2015
Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentic
23RISK
open ↗
Exploit-DB
Gecko CMS 2.3 - Multiple Vulnerabilities
CVE-2015-1422—webappsphp13 Jan 2015
Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary
23RISK
open ↗
Exploit-DB
Gecko CMS 2.3 - Multiple Vulnerabilities
CVE-2015-1423—webappsphp13 Jan 2015
Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL com
23RISK
open ↗
Exploit-DB
D-Link DSL-2730B Modem - Cross-Site Scripting Injection Stored Wlsecrefresh.wl & Wlsecurity.wl
CVE-2015-1028—webappshardware11 Jan 2015
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remo
23RISK
open ↗
Exploit-DB
D-Link DSL-2730B Modem - Cross-Site Scripting Injection Stored DnsProxy.cmd
CVE-2015-1028—webappshardware11 Jan 2015
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remo
23RISK
open ↗
Exploit-DB
D-Link DSL-2730B Modem - 'Lancfg2get.cgi Persistent Cross-Site Scripting
CVE-2015-1028—webappshardware11 Jan 2015
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remo
23RISK
open ↗
Exploit-DB
Apple Mac OSX 10.9.x - sysmond XPC Privilege Escalation
CVE-2014-8835—localosx10 Jan 2015
The xpc_data_get_bytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes ke
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Pandora FMS 3.1 - Authentication Bypass / Arbitrary File Upload (Metasploit)
CVE-2010-4279—remotephp08 Jan 2015
The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which al
50RISK
open ↗
Exploit-DB
WordPress Plugin Shopping Cart 3.0.4 - Unrestricted Arbitrary File Upload
CVE-2014-9308—webappsphp08 Jan 2015
Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka Wor
50RISK
open ↗
Exploit-DB
Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure
CVE-2015-0554—webappshardware07 Jan 2015
The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly rest
50RISK
open ↗
Exploit-DB
Sefrengo CMS 1.6.0 - SQL Injection
CVE-2015-0919—webappsphp07 Jan 2015
Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrator
23RISK
open ↗
Exploit-DB
Microweber CMS 0.95 - SQL Injection
CVE-2014-9464—webappsphp07 Jan 2015
SQL injection vulnerability in Category.php in Microweber CMS 0.95 before 20141209 allows remote attackers to execute ar
23RISK
open ↗
Exploit-DB
AdaptCMS 3.0.3 - Multiple Vulnerabilities
CVE-2015-1059—webappsphp06 Jan 2015
Unrestricted file upload vulnerability in admin/files/add in AdaptCMS 3.0.3 allows remote authenticated users to execute
23RISK
open ↗
Exploit-DB✓ VexDay Proof
BulletProof FTP Client - BPS Buffer Overflow (Metasploit)
CVE-2014-2973—localwindows06 Jan 2015
35RISK
open ↗
Exploit-DB
AdaptCMS 3.0.3 - Multiple Vulnerabilities
CVE-2015-1058—webappsphp06 Jan 2015
Multiple cross-site scripting (XSS) vulnerabilities in AdaptCMS 3.0.3 allow remote attackers to inject arbitrary web scr
23RISK
open ↗
Exploit-DB
Nexus 5 Android 5.0 - Local Privilege Escalation
CVE-2014-4322—localandroid06 Jan 2015
drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Andr
23RISK
open ↗
Exploit-DB
AdaptCMS 3.0.3 - Multiple Vulnerabilities
CVE-2015-1060—webappsphp06 Jan 2015
Open redirect vulnerability in lib/Cake/Controller/Controller.php in AdaptCMS 3.0.3 allows remote attackers to redirect
23RISK
open ↗
Exploit-DB✓ VexDay Proof
OP5 5.3.5/5.4.0/5.4.2/5.5.0/5.5.1 - 'welcome' Remote Command Execution (Metasploit)
CVE-2012-0262—webappsmultiple05 Jan 2015
op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers
60RISK
open ↗
← previouspage 204 / 815next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.