Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,896cataloged exploits
40,390CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,017VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
WordPress Core < 4.0.1 - Denial of Service
CVE-2014-9034—dosphp01 Dec 2014
wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 all
45RISK
open ↗
Exploit-DB
Drupal < 7.34 - Denial of Service
CVE-2014-9016—dosphp01 Dec 2014
The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x
60RISK
open ↗
Exploit-DB
WordPress Core 4.0 - Denial of Service
CVE-2014-9034—dosphp01 Dec 2014
wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 all
45RISK
open ↗
Exploit-DB
CCH Wolters Kluwer PFX Engagement 7.1 - Local Privilege Escalation
CVE-2014-9113—localwindows28 Nov 2014
CCH Wolters Kluwer ProSystem fx Engagement (aka PFX Engagement) 7.1 and earlier uses weak permissions (Authenticated Use
23RISK
open ↗
Exploit-DB
Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 - '.wax' Local Buffer Overflow (SEH)
CVE-2014-9448—localwindows26 Nov 2014
Buffer overflow in Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 allows remote attackers to execute arbitrary code or
23RISK
open ↗
Exploit-DB
xEpan 1.0.1 - Cross-Site Request Forgery
CVE-2014-8429—webappsphp26 Nov 2014
Cross-site request forgery (CSRF) vulnerability in Xavoc Technocrats xEpan CMS 1.0.4.1, 1.0.4, 1.0.1, and earlier allows
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin DB Backup - Arbitrary File Download
CVE-2014-9119—webappsphp26 Nov 2014
Directory traversal vulnerability in download.php in the DB Backup plugin 4.5 and earlier for Wordpress allows remote at
43RISK
open ↗
Exploit-DB
Elipse E3 - HTTP Denial of Service
CVE-2014-8652—doswindows26 Nov 2014
Elipse E3 3.x and earlier allows remote attackers to cause a denial of service (application crash and plant outage) via
23RISK
open ↗
Exploit-DB
Android WAPPushManager - SQL Injection
CVE-2014-8507—dosandroid26 Nov 2014
Multiple SQL injection vulnerabilities in the queryLastApp method in packages/WAPPushManager/src/com/android/smspush/Wap
23RISK
open ↗
Exploit-DB
Arris VAP2500 - Authentication Bypass
CVE-2014-8423—webappshardware25 Nov 2014
Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute ar
50RISK
open ↗
Exploit-DB
Arris VAP2500 - Authentication Bypass
CVE-2014-8424—webappshardware25 Nov 2014
ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authenticatio
50RISK
open ↗
Exploit-DB
TRENDnet SecurView Wireless Network Camera TV-IP422WN - 'UltraCamX.ocx' Stack Buffer Overflow (PoC)
CVE-2014-10011—doswindows25 Nov 2014
Stack-based buffer overflow in UltraCamLib in the UltraCam ActiveX Control (UltraCamX.ocx) for the TRENDnet SecurView ca
28RISK
open ↗
Exploit-DB
WordPress Plugin Google Document Embedder 2.5.14 - SQL Injection
CVE-2014-9173—webappsphp25 Nov 2014
SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote atta
23RISK
open ↗
Exploit-DB
Linux Kernel 3.14.5 (CentOS 7 / RHEL) - 'libfutex' Local Privilege Escalation
CVE-2014-3153HIGHunder attacklocallinux25 Nov 2014
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two diff
98RISK
open ↗
Exploit-DB
PHPMyRecipes 1.2.2 - 'dosearch.php?words_exact' SQL Injection
CVE-2014-9347—webappsphp25 Nov 2014
SQL injection vulnerability in dosearch.php in phpMyRecipes 1.2.2 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Exploit-DB
Arris VAP2500 - Authentication Bypass
CVE-2014-8425—webappshardware25 Nov 2014
The management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to obtain credentials by reading the confi
23RISK
open ↗
Exploit-DB
WordPress Plugin Download Manager 2.7.2 - Privilege Escalation
CVE-2014-9260—webappsphp24 Nov 2014
The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Advantech EKI-6340 - Command Injection
CVE-2014-8387—webappscgi24 Nov 2014
cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitrar
35RISK
open ↗
Exploit-DB
RobotStats 1.0 - HTML Injection
CVE-2014-9349—dosaix24 Nov 2014
Multiple cross-site scripting (XSS) vulnerabilities in admin/robots.lib.php in RobotStats 1.0 allow remote attackers to
23RISK
open ↗
Exploit-DB
RobotStats 1.0 - 'robot' SQL Injection
CVE-2014-9348—webappsphp24 Nov 2014
SQL injection vulnerability in the formulaireRobot function in admin/robots.lib.php in RobotStats 1.0 allows remote atta
23RISK
open ↗
Exploit-DB
tcpdump 4.6.2 - Geonet Decoder Denial of Service
CVE-2014-8768—dosmultiple24 Nov 2014
Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow rem
28RISK
open ↗
Exploit-DB
Microsoft Windows 8.1/ Server 2012 - 'Win32k.sys' Local Privilege Escalation (MS14-058)
CVE-2014-4113HIGHunder attacklocalwindows24 Nov 2014
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 a
100RISK
open ↗
Exploit-DB
WordPress Plugin wpDataTables 1.5.3 - SQL Injection
CVE-2014-9175—webappsphp24 Nov 2014
SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote
23RISK
open ↗
Exploit-DB
TP-Link TL-WR740N - Denial of Service
CVE-2014-9350—doshardware24 Nov 2014
TP-Link TL-WR740N 4 with firmware 3.17.0 Build 140520, 3.16.6 Build 130529, and 3.16.4 Build 130205 allows remote attack
23RISK
open ↗
Exploit-DB
WordPress Plugin DukaPress 2.5.2 - Directory Traversal
CVE-2014-8799—webappsphp24 Nov 2014
Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Hikvision DVR - RTSP Request Remote Code Execution (Metasploit)
CVE-2014-4880—remotelinux24 Nov 2014
Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009, and other models and versions, allows remote atta
60RISK
open ↗
Exploit-DB
WordPress Plugin CM Download Manager 2.0.0 - Code Injection
CVE-2014-8877—webappsphp22 Nov 2014
The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plug
28RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin SP Client Document Manager 2.4.1 - SQL Injection
CVE-2014-9178—webappsphp21 Nov 2014
Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plu
23RISK
open ↗
Exploit-DB
FluxBB < 1.5.6 - SQL Injection
CVE-2014-10029—webappsmultiple21 Nov 2014
SQL injection vulnerability in profile.php in FluxBB before 1.4.13 and 1.5.x before 1.5.7 allows remote attackers to exe
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer OLE Pre-IE11 - Automation Array Remote Code Execution / PowerShell VirtualAlloc (MS14-064)
CVE-2014-6332HIGHunder attackremotewindows20 Nov 2014
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISK
open ↗
← previouspage 209 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.