Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,679cataloged exploits
40,329CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
NPDS CMS REvolution-13 - SQL Injection
CVE-2015-1400—webappsphp24 Jan 2015
SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB
ManageEngine ServiceDesk Plus 9.0 - SQL Injection
CVE-2015-1479—webappsjsp22 Jan 2015
SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 buil
23RISK
open ↗
Exploit-DB
ecommerceMajor - SQL Injection / Authentication Bypass
CVE-2015-1476—webappsphp22 Jan 2015
Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Exploit-DB
Exif Pilot 4.7.2 - Buffer Overflow (SEH)
CVE-2015-1362—doswindows22 Jan 2015
Buffer overflow in the Customize 35mm tab in Two Pilots Exif Pilot 4.7.2 allows remote attackers to execute arbitrary co
23RISK
open ↗
Exploit-DB
ArticleFR CMS 3.0.5 - SQL Injection
CVE-2015-1364—webappsphp21 Jan 2015
SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3.
23RISK
open ↗
Exploit-DB
Zhone GPON 2520 R4.0.2.566b - Crash (PoC)
CVE-2015-2055—doshardware21 Jan 2015
Zhone GPON 2520 with firmware R4.0.2.566b allows remote attackers to cause a denial of service via a long string in the
23RISK
open ↗
Exploit-DB
WordPress Plugin Pixarbay Images 2.3 - Multiple Vulnerabilities
CVE-2015-1375—webappsphp20 Jan 2015
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload
28RISK
open ↗
Exploit-DB✓ VexDay Proof
ManageEngine (Multiple Products) - (Authenticated) Arbitrary File Upload (Metasploit)
CVE-2014-5301—remotejava20 Jan 2015
Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 t
60RISK
open ↗
Exploit-DB
WordPress Plugin Pixarbay Images 2.3 - Multiple Vulnerabilities
CVE-2015-1365—webappsphp20 Jan 2015
Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows rem
28RISK
open ↗
Exploit-DB
Malwarebytes Anti-Exploit 1.03.1.1220/1.04.1.1012 - Out-of-Bounds Read Denial of Service
CVE-2014-100039—doswindows20 Jan 2015
mbae.sys in Malwarebytes Anti-Exploit before 1.05.1.2014 allows local users to cause a denial of service (crash) via a c
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple Mac OSX networkd - 'effective_audit_token' XPC Type Confusion Sandbox Escape
CVE-2014-4492—localosx20 Jan 2015
libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain
28RISK
open ↗
Exploit-DB
WordPress Plugin Pixarbay Images 2.3 - Multiple Vulnerabilities
CVE-2015-1366—webappsphp20 Jan 2015
Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress all
23RISK
open ↗
Exploit-DB
WordPress Plugin Pixarbay Images 2.3 - Multiple Vulnerabilities
CVE-2015-1376—webappsphp20 Jan 2015
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remot
50RISK
open ↗
Exploit-DB
WordPress Plugin Cforms 14.7 - Remote Code Execution
CVE-2014-9473—webappsphp19 Jan 2015
Unrestricted file upload vulnerability in lib_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows r
28RISK
open ↗
Exploit-DB
Samsung SmartViewer BackupToAvi 3.0 - Remote Code Execution
CVE-2014-9265—remotewindows19 Jan 2015
Stack-based buffer overflow in the BackupToAvi method in the CNC_Ctrl ActiveX control in Samsung SmartViewer allows remo
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows < 8.1 (x86/x64) - User Profile Service Privilege Escalation (MS15-003)
CVE-2015-0004—localwindows18 Jan 2015
The User Profile Service (aka ProfSvc) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2
23RISK
open ↗
Exploit-DB
Lorex LH300 Series - ActiveX Buffer Overflow (PoC)
CVE-2014-1201—doshardware18 Jan 2015
Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B
28RISK
open ↗
Exploit-DB
WordPress Plugin Pie Register 2.0.13 - Privilege Escalation
CVE-2014-8802—webappsphp16 Jan 2015
The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-regist
23RISK
open ↗
Exploit-DB
Sim Editor 6.6 - Local Stack Buffer Overflow
CVE-2015-1171—localwindows16 Jan 2015
Stack-based buffer overflow in GSM SIM Utility (aka SIM Card Editor) 6.6 allows remote attackers to execute arbitrary co
50RISK
open ↗
Exploit-DB
ManageEngine Desktop Central - Create Administrator
CVE-2014-7862—webappsmultiple15 Jan 2015
The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote at
60RISK
open ↗
Exploit-DB
Ansible Tower 2.0.2 - Multiple Vulnerabilities
CVE-2015-1481—webappsmultiple14 Jan 2015
Ansible Tower (aka Ansible UI) before 2.0.5 allows remote organization administrators to gain privileges by creating a s
23RISK
open ↗
Exploit-DB
Ansible Tower 2.0.2 - Multiple Vulnerabilities
CVE-2015-1482—webappsmultiple14 Jan 2015
Ansible Tower (aka Ansible UI) before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive inform
23RISK
open ↗
Exploit-DB
Ansible Tower 2.0.2 - Multiple Vulnerabilities
CVE-2015-1368—webappsmultiple14 Jan 2015
Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attacker
23RISK
open ↗
Exploit-DB
Gecko CMS 2.3 - Multiple Vulnerabilities
CVE-2015-1422—webappsphp13 Jan 2015
Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary
23RISK
open ↗
Exploit-DB
Gecko CMS 2.3 - Multiple Vulnerabilities
CVE-2015-1423—webappsphp13 Jan 2015
Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL com
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Oracle MySQL (Windows) - FILE Privilege Abuse (Metasploit)
CVE-2012-5613—remotewindows13 Jan 2015
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the
50RISK
open ↗
Exploit-DB
Gecko CMS 2.3 - Multiple Vulnerabilities
CVE-2015-1424—webappsphp13 Jan 2015
Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentic
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Lexmark MarkVision Enterprise - Arbitrary File Upload (Metasploit)
CVE-2014-8741—remotejava13 Jan 2015
Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allo
60RISK
open ↗
Exploit-DB
Dell iDRAC IPMI 1.5 - Insufficient Session ID Randomness
CVE-2014-8272—webappshardware13 Jan 2015
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
28RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin WP Symposium 14.11 - Arbitrary File Upload (Metasploit)
CVE-2014-10021—remotephp13 Jan 2015
Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote
50RISK
open ↗
← previouspage 205 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.