Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,899cataloged exploits
40,392CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 11 - OLE Automation Array Remote Code Execution (1)
CVE-2014-6332HIGHunder attackremotewindows13 Nov 2014
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISK
open ↗
Exploit-DB
Proticaret E-Commerce Script 3.0 - SQL Injection (1)
CVE-2014-9237—webappsmultiple13 Nov 2014
SQL injection vulnerability in Proticaret E-Commerce 3.0 allows remote attackers to execute arbitrary SQL commands via a
23RISK
open ↗
Exploit-DB
WordPress Plugin SupportEzzy Ticket System 1.2.5 - Persistent Cross-Site Scripting
CVE-2014-9179—webappsphp12 Nov 2014
Cross-site scripting (XSS) vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote authe
23RISK
open ↗
Exploit-DB
Microsoft Office 2007/2010 - OLE Arbitrary Command Execution
CVE-2014-6352HIGHunder attacklocalwindows12 Nov 2014
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2
100RISK
open ↗
Exploit-DB
Microsoft Office 2007/2010 - OLE Arbitrary Command Execution
CVE-2014-4114HIGHunder attacklocalwindows12 Nov 2014
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2
100RISK
open ↗
Exploit-DB
Subex Fms 7.4 - SQL Injection
CVE-2014-8728—webappsmultiple11 Nov 2014
SQL injection vulnerability in the login page (login/login) in Subex ROC Fraud Management (aka Fraud Management System a
23RISK
open ↗
Exploit-DB
WordPress Plugin Photo Gallery 1.2.5 - Unrestricted Arbitrary File Upload
CVE-2014-9312—webappsphp11 Nov 2014
Unrestricted File Upload vulnerability in Photo Gallery 1.2.5.
50RISK
open ↗
Exploit-DB
Password Manager Pro / Pro MSP - Blind SQL Injection
CVE-2014-8498—webappsmultiple10 Nov 2014
SQL injection vulnerability in BulkEditSearchResult.cc in ManageEngine Password Manager Pro (PMP) and Password Manager P
28RISK
open ↗
Exploit-DB
WordPress Plugin / Joomla! Component XCloner - Multiple Vulnerabilities
CVE-2014-8604—webappsphp10 Nov 2014
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in th
23RISK
open ↗
Exploit-DB
ManageEngine OpManager / Social IT Plus / IT360 - Multiple Vulnerabilities
CVE-2014-7868—webappsjsp10 Nov 2014
Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT
45RISK
open ↗
Exploit-DB✓ VexDay Proof
phpSound Music Sharing Platform 1.0.5 - Multiple Cross-Site Scripting Vulnerabilities
CVE-2014-8954—webappsphp10 Nov 2014
Multiple cross-site scripting (XSS) vulnerabilities in phpSound 1.0.5 allow remote attackers to inject arbitrary web scr
23RISK
open ↗
Exploit-DB
WordPress Plugin / Joomla! Component XCloner - Multiple Vulnerabilities
CVE-2014-8607—webappsphp10 Nov 2014
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command lin
23RISK
open ↗
Exploit-DB✓ VexDay Proof
vldPersonals 2.7 - Multiple Vulnerabilities
CVE-2014-9005—webappsphp10 Nov 2014
Multiple SQL injection vulnerabilities in vldPersonals before 2.7.1 allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Exploit-DB
WordPress Plugin / Joomla! Component XCloner - Multiple Vulnerabilities
CVE-2014-8605—webappsphp10 Nov 2014
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under t
23RISK
open ↗
Exploit-DB
WordPress Plugin Another WordPress Classifieds Plugin - SQL Injection
CVE-2014-10013—webappsphp10 Nov 2014
SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to
23RISK
open ↗
Exploit-DB
Password Manager Pro / Pro MSP - Blind SQL Injection
CVE-2014-8499—webappsmultiple10 Nov 2014
Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Servi
50RISK
open ↗
Exploit-DB
PHP-Fusion 7.02.07 - SQL Injection
CVE-2014-8596—webappsphp10 Nov 2014
Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL c
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Visual Mining NetCharts Server - Remote Code Execution (Metasploit)
CVE-2014-8516—remotejava10 Nov 2014
Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary co
60RISK
open ↗
Exploit-DB
ManageEngine OpManager / Social IT Plus / IT360 - Multiple Vulnerabilities
CVE-2014-7866—webappsjsp10 Nov 2014
Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and
45RISK
open ↗
Exploit-DB
WordPress Plugin / Joomla! Component XCloner - Multiple Vulnerabilities
CVE-2014-8606—webappsphp10 Nov 2014
Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administ
23RISK
open ↗
Exploit-DB
WordPress Plugin / Joomla! Component XCloner - Multiple Vulnerabilities
CVE-2014-8603—webappsphp10 Nov 2014
cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to exe
23RISK
open ↗
Exploit-DB✓ VexDay Proof
vldPersonals 2.7 - Multiple Vulnerabilities
CVE-2014-9004—webappsphp10 Nov 2014
Cross-site scripting (XSS) vulnerability in vldPersonals before 2.7.1 allows remote attackers to inject arbitrary web sc
23RISK
open ↗
Exploit-DB
ManageEngine OpManager / Social IT Plus / IT360 - Multiple Vulnerabilities
CVE-2014-7866—webappsmultiple09 Nov 2014
Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and
45RISK
open ↗
Exploit-DB
ManageEngine OpManager / Social IT Plus / IT360 - Multiple Vulnerabilities
CVE-2014-7868—webappsmultiple09 Nov 2014
Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT
45RISK
open ↗
Exploit-DB
ManageEngine OpManager / Social IT Plus / IT360 - Multiple Vulnerabilities
CVE-2014-6036—webappsmultiple09 Nov 2014
Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Socia
35RISK
open ↗
Exploit-DB
ManageEngine OpManager / Social IT Plus / IT360 - Multiple Vulnerabilities
CVE-2014-6034—webappsmultiple09 Nov 2014
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in Z
60RISK
open ↗
Exploit-DB
ManageEngine OpManager / Social IT Plus / IT360 - Multiple Vulnerabilities
CVE-2014-6035—webappsmultiple09 Nov 2014
Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier al
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Citrix Netscaler SOAP Handler - Remote Code Execution (Metasploit)
CVE-2014-7140—remotebsd06 Nov 2014
Unspecified vulnerability in the management interface in Citrix NetScaler Application Delivery Controller (ADC) and NetS
28RISK
open ↗
Exploit-DB
Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities
CVE-2014-3439—webappsjsp06 Nov 2014
ConsoleServlet in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to write to arbitr
23RISK
open ↗
Exploit-DB
Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities
CVE-2014-3438—webappsjsp06 Nov 2014
Multiple cross-site scripting (XSS) vulnerabilities in console interface scripts in Symantec Endpoint Protection Manager
23RISK
open ↗
← previouspage 211 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.