Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,526cataloged exploits
34,478CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,534GitHub PoC 13,654VulnCheck XDB 8,213Nuclei 4,218Metasploit 3,464✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB
SkinCrafter3 vs2005 3.8.1.0 - Multiple ActiveX Buffer Overflows
CVE-2012-2271—remotewindows05 Jan 2015
Buffer overflow in the InitLicenKeys function in a certain ActiveX control in SkinCrafter3_vs2005.dll in SkinCrafter 3.0
23RISK
open ↗
Exploit-DB✓ VexDay Proof
ASUSWRT 3.0.0.4.376_1071 - LAN Backdoor Command Execution
CVE-2014-9583—remotehardware04 Jan 2015
common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC
60RISK
open ↗
Exploit-DB
Crea8Social 2.0 - Cross-Site Scripting Change Interface
CVE-2015-1054—webappsphp04 Jan 2015
Cross-site scripting (XSS) vulnerability in the Games feature in Crea8Social 2.0 allows remote authenticated users to in
23RISK
open ↗
Exploit-DB
PhotoPost < 4.85 - Multiple Vulnerabilities
CVE-2005-0273—webappsphp03 Jan 2015
Multiple SQL injection vulnerabilities in showgallery.php in PhotoPost before 4.86 allow remote attackers to execute arb
23RISK
open ↗
Exploit-DB✓ VexDay Proof
e107 2 Bootstrap CMS - Cross-Site Scripting
CVE-2015-1057—webappsphp03 Jan 2015
Cross-site scripting (XSS) vulnerability in usersettings.php in e107 2.0.0 allows remote attackers to inject arbitrary w
23RISK
open ↗
Exploit-DB
PhotoPost < 4.85 - Multiple Vulnerabilities
CVE-2005-0274—webappsphp03 Jan 2015
Multiple cross-site scripting (XSS) vulnerabilities in showgallery.php in PhotoPost before 4.86 allow remote attackers t
23RISK
open ↗
Exploit-DB
ReviewPost < 2.84 - Multiple Vulnerabilities
CVE-2005-0271—webappsphp02 Jan 2015
Multiple SQL injection vulnerabilities in ReviewPost PHP Pro before 2.84 allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Exploit-DB
ReviewPost < 2.84 - Multiple Vulnerabilities
CVE-2005-0272—webappsphp02 Jan 2015
ReviewPost PHP Pro before 2.84 allows remote attackers to upload and execute arbitrary PHP files by posting a review fil
23RISK
open ↗
Exploit-DB
ReviewPost < 2.84 - Multiple Vulnerabilities
CVE-2005-0270—webappsphp02 Jan 2015
Multiple cross-site scripting (XSS) vulnerabilities in ReviewPost PHP Pro before 2.84 allow remote attackers to inject a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows 8.1 (x86/x64) - 'ahcache.sys' NtApphelpCacheControl Privilege Escalation
CVE-2015-0002—localwindows01 Jan 2015
The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility component in Microsoft Windows 7 SP1,
43RISK
open ↗
Exploit-DB
Absolut Engine 1.73 - Multiple Vulnerabilities
CVE-2014-9435—webappsphp01 Jan 2015
Multiple SQL injection vulnerabilities in Absolut Engine 1.73 allow remote authenticated users to execute arbitrary SQL
23RISK
open ↗
Exploit-DB
Absolut Engine 1.73 - Multiple Vulnerabilities
CVE-2014-9434—webappsphp01 Jan 2015
Cross-site scripting (XSS) vulnerability in admin/managerrelated.php in the administrative backend in Absolut Engine 1.7
23RISK
open ↗
Exploit-DB✓ VexDay Proof
ProjectSend - Arbitrary File Upload (Metasploit)
CVE-2014-9567—remotephp31 Dec 2014
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows rem
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Social Microblogging PRO 1.5 - Persistent Cross-Site Scripting
CVE-2014-9516—webappsphp31 Dec 2014
Cross-site scripting (XSS) vulnerability in Social Microblogging PRO 1.5 allows remote attackers to inject arbitrary web
23RISK
open ↗
Exploit-DB
PHP-Calendar < 0.10.1 - Arbitrary File Inclusion
CVE-2004-1423—webappsphp29 Dec 2014
Multiple PHP remote file inclusion vulnerabilities in Sean Proctor PHP-Calendar before 0.10.1, as used in Commonwealth o
28RISK
open ↗
Exploit-DB
WHM.AutoPilot < 2.4.6.5 - Multiple Vulnerabilities
CVE-2004-1422—webappsphp27 Dec 2014
WHM AutoPilot 2.4.6.5 and earlier allows remote attackers to gain sensitive information via phpinfo, which reveals php s
23RISK
open ↗
Exploit-DB
WHM.AutoPilot < 2.4.6.5 - Multiple Vulnerabilities
CVE-2004-1420—webappsphp27 Dec 2014
Multiple cross-site scripting (XSS) vulnerabilities in header.php in WHM AutoPilot 2.4.6.5 and earlier allow remote atta
23RISK
open ↗
Exploit-DB
Easy File Sharing Web Server 6.8 - Persistent Cross-Site Scripting
CVE-2014-9439—webappsphp27 Dec 2014
Cross-site scripting (XSS) vulnerability in Easy File Sharing Web Server 6.8 allows remote attackers to inject arbitrary
23RISK
open ↗
Exploit-DB
WHM.AutoPilot < 2.4.6.5 - Multiple Vulnerabilities
CVE-2004-1421—webappsphp27 Dec 2014
Multiple PHP remote file inclusion vulnerabilities (1) step_one.php, (2) step_one_tables.php, (3) step_two_tables.php in
23RISK
open ↗
Exploit-DB
PMB 4.1.3 - (Authenticated) SQL Injection
CVE-2014-9457—webappsphp27 Dec 2014
SQL injection vulnerability in classes/mono_display.class.php in PMB 4.1.3 and earlier allows remote authenticated users
23RISK
open ↗
Exploit-DB
PHPMyRecipes 1.2.2 - 'browse.php?category' SQL Injection
CVE-2014-9440—webappsphp23 Dec 2014
SQL injection vulnerability in browse.php in phpMyRecipes 1.2.2 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB
GParted 0.14.1 - OS Command Execution
CVE-2014-7208—locallinux23 Dec 2014
GParted before 0.15.0 allows local users to execute arbitrary commands with root privileges via shell metacharacters in
23RISK
open ↗
Exploit-DB
NetIQ Access Manager 4.0 SP1 - Multiple Vulnerabilities
CVE-2014-5216—webappsjsp23 Dec 2014
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote atta
23RISK
open ↗
Exploit-DB
NetIQ Access Manager 4.0 SP1 - Multiple Vulnerabilities
CVE-2014-9412—webappsjsp23 Dec 2014
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers
23RISK
open ↗
Exploit-DB
SysAid Server - Arbitrary File Disclosure
CVE-2014-9436—webappswindows23 Dec 2014
Absolute path traversal vulnerability in SysAid On-Premise before 14.4.2 allows remote attackers to read arbitrary files
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Notepad++ 6.6.9 - Buffer Overflow
CVE-2014-1004—doswindows22 Dec 2014
20RISK
open ↗
Exploit-DB
PsychoStats < 2.2.4 Beta - Cross Site Scripting
CVE-2004-1417—localwindows22 Dec 2014
Cross-site scripting (XSS) vulnerability in login.php in PsychoStats 2.2.4 Beta and earlier allows remote attackers to i
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Notepad++ 6.6.9 - Buffer Overflow
CVE-2014-9456—doswindows22 Dec 2014
Buffer overflow in NotePad++ 6.6.9 allows remote attackers to have unspecified impact via a long Time attribute in an Ev
28RISK
open ↗
Exploit-DB
ProjectSend r561 - Multiple Vulnerabilities
CVE-2014-9580—webappsphp19 Dec 2014
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary
23RISK
open ↗
Exploit-DB
ProjectSend r561 - Multiple Vulnerabilities
CVE-2014-1155—webappsphp19 Dec 2014
20RISK
open ↗
← previouspage 205 / 815next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.