Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,894cataloged exploits
40,389CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,015VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
phpMyAdmin 4.0.x/4.1.x/4.2.x - Denial of Service
CVE-2014-9218—dosphp15 Dec 2014
libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows re
28RISK
open ↗
Exploit-DB
WordPress Plugin WP Symposium 14.11 - Arbitrary File Upload
CVE-2014-10021—webappsphp15 Dec 2014
Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote
50RISK
open ↗
Exploit-DB
GLPI 0.85 - Blind SQL Injection
CVE-2014-9258—webappsphp15 Dec 2014
SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to exec
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Tuleap - PHP Unserialize Code Execution (Metasploit)
CVE-2014-8791—remotephp15 Dec 2014
project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated
43RISK
open ↗
Exploit-DB
IBM Tivoli Service Automation Manager 7.2.4 - Remote Code Execution
CVE-2015-0104—webappsjsp12 Dec 2014
IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database
23RISK
open ↗
Exploit-DB
IBM Tivoli Service Automation Manager 7.2.4 - Remote Code Execution
CVE-2015-0107—webappsjsp12 Dec 2014
IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database
23RISK
open ↗
Exploit-DB✓ VexDay Proof
OpenEMR 4.1.2(7) - Multiple SQL Injections
CVE-2014-5462—webappsphp10 Dec 2014
Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execut
23RISK
open ↗
Exploit-DB
Humhub 0.10.0-rc.1 - SQL Injection
CVE-2014-9528—webappsphp10 Dec 2014
SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListControlle
23RISK
open ↗
Exploit-DB
Advantech AdamView 4.30.003 - '.gni' Local Buffer Overflow (SEH)
CVE-2014-8386—localwindows09 Dec 2014
Multiple stack-based buffer overflows in Advantech AdamView 4.3 and earlier allow remote attackers to execute arbitrary
23RISK
open ↗
Exploit-DB
WordPress Plugin Symposium 14.10 - SQL Injection
CVE-2014-8810—webappsphp09 Dec 2014
SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium plugin before 14.11 for WordPress allows remo
23RISK
open ↗
Exploit-DB
PBBoard CMS 3.0.1 - SQL Injection
CVE-2014-9215—webappsphp05 Dec 2014
SQL injection vulnerability in the CheckEmail function in includes/functions.class.php in PBBoard 3.0.1 before 20141128
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows Kerberos - Privilege Escalation (MS14-068)
CVE-2014-6324HIGHunder attackremotewindows05 Dec 2014
The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008
100RISK
open ↗
Exploit-DB
Advertise With Pleasure! (AWP) 6.6 - SQL Injection
CVE-2014-9345—webappscgi04 Dec 2014
SQL injection vulnerability in Guruperl.net Advertise With Pleasure! Professional (aka AWP PRO) 6.6 and earlier allows r
23RISK
open ↗
Exploit-DB
Technicolor DT5130 2.05.C29GV - Multiple Vulnerabilities
CVE-2014-9142—webappshardware04 Dec 2014
Cross-site scripting (XSS) vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers t
23RISK
open ↗
Exploit-DB
Technicolor DT5130 2.05.C29GV - Multiple Vulnerabilities
CVE-2014-9144—webappshardware04 Dec 2014
Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to execute arbitrary commands via shell metac
23RISK
open ↗
Exploit-DB
Technicolor DT5130 2.05.C29GV - Multiple Vulnerabilities
CVE-2014-9143—webappshardware04 Dec 2014
Open redirect vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to redirect us
23RISK
open ↗
Exploit-DB
ManageEngine Netflow Analyzer / IT360 - Arbitrary File Download
CVE-2014-5446—webappsmultiple03 Dec 2014
Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2
35RISK
open ↗
Exploit-DB
WordPress Plugin Google Document Embedder 2.5.16 - 'mysql_real_escpae_string' Bypass SQL Injection
CVE-2014-9173—webappsphp03 Dec 2014
SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote atta
23RISK
open ↗
Exploit-DB
ManageEngine Netflow Analyzer / IT360 - Arbitrary File Download
CVE-2014-5445—webappsmultiple03 Dec 2014
Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 a
60RISK
open ↗
Exploit-DB
WordPress Plugin Cart66 Lite eCommerce 1.5.1.17 - Blind SQL Injection
CVE-2014-9305—webappsphp03 Dec 2014
SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin be
23RISK
open ↗
Exploit-DB
BulletProof FTP Client 2010 - Local Buffer Overflow (SEH)
CVE-2014-2973—localwindows03 Dec 2014
35RISK
open ↗
Exploit-DB
tnftp (FreeBSD 8/9/10) - 'tnftp' Client Side
CVE-2014-8517—remotebsd02 Dec 2014
The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 thro
50RISK
open ↗
Exploit-DB
WordPress Plugin Nextend Facebook Connect 1.4.59 - Cross-Site Scripting
CVE-2014-8800—webappsphp02 Dec 2014
Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Tincd - (Authenticated) Remote TCP Stack Buffer Overflow (Metasploit)
CVE-2013-1428—remotemultiple02 Dec 2014
Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pr
50RISK
open ↗
Exploit-DB
TYPO3 Extension ke DomPDF - Remote Code Execution
CVE-2014-6235—webappsphp02 Dec 2014
Unspecified vulnerability in the ke DomPDF extension before 0.0.5 for TYPO3 allows remote attackers to execute arbitrary
23RISK
open ↗
Exploit-DB
ProjectSend r-561 - Arbitrary File Upload
CVE-2014-9567—webappsphp02 Dec 2014
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows rem
50RISK
open ↗
Exploit-DB
EntryPass N5200 - Credentials Exposure
CVE-2014-8868—webappshardware02 Dec 2014
EntryPass N5200 Active Network Control Panel does not properly restrict access, which allows remote attackers to obtain
23RISK
open ↗
Exploit-DB
EntryPass N5200 - Credentials Exposure
CVE-2014-9303—webappshardware02 Dec 2014
EntryPass N5200 Active Network Control Panel allows remote attackers to read device memory and obtain the administrator
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple Mac OSX - IOKit Keyboard Driver Privilege Escalation (Metasploit)
CVE-2014-4404HIGHunder attacklocalosx02 Dec 2014
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitr
98RISK
open ↗
Exploit-DB
Thomson Reuters Fixed Assets CS 13.1.4 - Local Privilege Escalation
CVE-2014-9141—localwindows02 Dec 2014
The installer in Thomson Reuters Fixed Assets CS 13.1.4 and earlier uses weak permissions for connectbgdl.exe, which all
23RISK
open ↗
← previouspage 208 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.