Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,526cataloged exploits

34,478CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,534GitHub PoC 13,654VulnCheck XDB 8,213Nuclei 4,218Metasploit 3,464✓ verified onlyrecent popular risk

24,443 exploits

Exploit-DB

PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection

CVE-2014-62771—webappsphp03 Nov 2014

20RISK

Exploit-DB

PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection

CVE-2014-7227—webappsphp03 Nov 2014

20RISK

Exploit-DB

PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection

CVE-2014-7196—webappsphp03 Nov 2014

20RISK

Exploit-DB

Progress OpenEdge 11.2 - Directory Traversal

CVE-2014-8555—webappsjsp31 Oct 2014

Directory traversal vulnerability in report/reportViewAction.jsp in Progress Software OpenEdge 11.2 allows remote attack

23RISK

Exploit-DB

Who's Who Script - Cross-Site Request Forgery (Add Admin)

CVE-2014-8953—webappsphp31 Oct 2014

Multiple cross-site request forgery (CSRF) vulnerabilities in Php Scriptlerim Who's Who script allow remote attackers to

23RISK

Exploit-DB✓ VexDay Proof

MAARCH 1.4 - Arbitrary File Upload

CVE-2015-1587—webappsphp29 Oct 2014

Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earl

50RISK

Exploit-DB

Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 - '.wax' File Buffer Overflow (Denial of Service) (PoC) EIP Overwrite

CVE-2014-9448—doswindows29 Oct 2014

Buffer overflow in Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 allows remote attackers to execute arbitrary code or

23RISK

Exploit-DB

Konke Smart Plug K - Authentication Bypass

CVE-2014-7279—remotehardware29 Oct 2014

The Konke Smart Plug K does not require authentication for TELNET sessions, which allows remote attackers to obtain "equ

28RISK

Exploit-DB✓ VexDay Proof

CUPS Filter - Bash Environment Variable Code Injection (Metasploit)

CVE-2014-3659—remotelinux29 Oct 2014

20RISK

Exploit-DB✓ VexDay Proof

CUPS Filter - Bash Environment Variable Code Injection (Metasploit)

CVE-2014-7910—remotelinux29 Oct 2014

Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service o

23RISK

Exploit-DB✓ VexDay Proof

CUPS Filter - Bash Environment Variable Code Injection (Metasploit)

CVE-2014-62771—remotelinux29 Oct 2014

20RISK

Exploit-DB✓ VexDay Proof

CUPS Filter - Bash Environment Variable Code Injection (Metasploit)

CVE-2014-6271CRITICALunder attackremotelinux29 Oct 2014

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RISK

Exploit-DB✓ VexDay Proof

CUPS Filter - Bash Environment Variable Code Injection (Metasploit)

CVE-2014-3671—remotelinux29 Oct 2014

20RISK

Exploit-DB✓ VexDay Proof

CUPS Filter - Bash Environment Variable Code Injection (Metasploit)

CVE-2014-7227—remotelinux29 Oct 2014

20RISK

Exploit-DB✓ VexDay Proof

CUPS Filter - Bash Environment Variable Code Injection (Metasploit)

CVE-2014-7169CRITICALunder attackremotelinux29 Oct 2014

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

100RISK

Exploit-DB✓ VexDay Proof

CUPS Filter - Bash Environment Variable Code Injection (Metasploit)

CVE-2014-7196—remotelinux29 Oct 2014

20RISK

Exploit-DB

IBM Tivoli Monitoring 6.2.2 kbbacf1 - Local Privilege Escalation

CVE-2013-5467—locallinux29 Oct 2014

Monitoring Agent for UNIX Logs 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, and 6.2.3 through FP04 and Mo

23RISK

Exploit-DB✓ VexDay Proof

Enalean Tuleap 7.4.99.5 - Blind SQL Injection

CVE-2014-7176—webappsphp28 Oct 2014

SQL injection vulnerability in Enalean Tuleap before 7.5.99.4 allows remote authenticated users to execute arbitrary SQL

23RISK

Exploit-DB✓ VexDay Proof

Enalean Tuleap 7.2 - XML External Entity File Disclosure

CVE-2014-7176—webappsphp28 Oct 2014

SQL injection vulnerability in Enalean Tuleap before 7.5.99.4 allows remote authenticated users to execute arbitrary SQL

23RISK

Exploit-DB✓ VexDay Proof

Microsoft Windows - TrackPopupMenu Win32k Null Pointer Dereference (MS14-058) (Metasploit)

CVE-2014-4113HIGHunder attacklocalwindows28 Oct 2014

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 a

100RISK

Exploit-DB✓ VexDay Proof

Enalean Tuleap 7.2 - XML External Entity File Disclosure

CVE-2014-7177—webappsphp28 Oct 2014

XML External Entity vulnerability in Enalean Tuleap 7.2 and earlier allows remote authenticated users to read arbitrary

23RISK

Exploit-DB✓ VexDay Proof

Enalean Tuleap 7.4.99.5 - Remote Command Execution

CVE-2014-7178—webappsphp28 Oct 2014

Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is

23RISK

Exploit-DB

Tapatalk for vBulletin 4.x - Blind SQL Injection

CVE-2014-2023—webappsphp28 Oct 2014

Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allo

23RISK

Exploit-DB

Incredible PBX 2.0.6.5.0 - Remote Command Execution

CVE-2014-9001—webappsphp27 Oct 2014

reminders/index.php in Incredible PBX 11 2.0.6.5.0 allows remote authenticated users to execute arbitrary commands via s

23RISK

Exploit-DB

CBN CH6640E/CG6640E Wireless Gateway Series - Multiple Vulnerabilities

CVE-2014-8656—webappshardware27 Oct 2014

The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a d

28RISK

Exploit-DB✓ VexDay Proof

Centreon - SQL Injection / Command Injection (Metasploit)

CVE-2014-3828—remoteunix27 Oct 2014

Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3

60RISK

Exploit-DB

Filemaker Pro 13.03 / Advanced 12.04 - Authentication Bypass / Privilege Escalation

CVE-2014-8347—localwindows27 Oct 2014

An Authentication Bypass vulnerability exists in the MatchPasswordData function in DBEngine.dll in Filemaker Pro 13.03 a

23RISK

Exploit-DB

CBN CH6640E/CG6640E Wireless Gateway Series - Multiple Vulnerabilities

CVE-2014-8655—webappshardware27 Oct 2014

The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows r

23RISK

Exploit-DB

CBN CH6640E/CG6640E Wireless Gateway Series - Multiple Vulnerabilities

CVE-2014-8653—webappshardware27 Oct 2014

Cross-site scripting (XSS) vulnerability in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 wit

23RISK

Exploit-DB

WordPress Plugin CP Multi View Event Calendar 1.01 - SQL Injection

CVE-2014-8586—webappsphp27 Oct 2014

SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to exe

50RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.