Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,526cataloged exploits

34,478CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,534GitHub PoC 13,654VulnCheck XDB 8,213Nuclei 4,218Metasploit 3,464✓ verified onlyrecent popular risk

24,443 exploits

Exploit-DB✓ VexDay Proof

Bash CGI - 'Shellshock' Remote Command Injection (Metasploit)

CVE-2014-7910—webappscgi06 Oct 2014

Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service o

23RISK

Exploit-DB✓ VexDay Proof

Bash CGI - 'Shellshock' Remote Command Injection (Metasploit)

CVE-2014-6271CRITICALunder attackwebappscgi06 Oct 2014

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RISK

Exploit-DB✓ VexDay Proof

Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection

CVE-2014-6271CRITICALunder attackremotelinux06 Oct 2014

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RISK

Exploit-DB✓ VexDay Proof

Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection

CVE-2014-7227—remotelinux06 Oct 2014

20RISK

Exploit-DB

OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection

CVE-2014-6271CRITICALunder attackremotelinux04 Oct 2014

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RISK

Exploit-DB

OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection

CVE-2014-7227—remotelinux04 Oct 2014

20RISK

Exploit-DB

OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection

CVE-2014-3659—remotelinux04 Oct 2014

20RISK

Exploit-DB

OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection

CVE-2014-7169CRITICALunder attackremotelinux04 Oct 2014

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

100RISK

Exploit-DB

OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection

CVE-2014-7910—remotelinux04 Oct 2014

Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service o

23RISK

Exploit-DB

OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection

CVE-2014-62771—remotelinux04 Oct 2014

20RISK

Exploit-DB

OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection

CVE-2014-7196—remotelinux04 Oct 2014

20RISK

Exploit-DB

OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection

CVE-2014-3671—remotelinux04 Oct 2014

20RISK

Exploit-DB✓ VexDay Proof

Pure-FTPd - External Authentication Bash Environment Variable Code Injection (Metasploit)

CVE-2014-7169CRITICALunder attackremotelinux02 Oct 2014

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

100RISK

Exploit-DB✓ VexDay Proof

Bacula-Web 5.2.10 - 'joblogs.php?jobid' SQL Injection

CVE-2014-8295—webappsphp02 Oct 2014

SQL injection vulnerability in joblogs.php in Bacula-Web 5.2.10 allows remote attackers to execute arbitrary SQL command

23RISK

Exploit-DB✓ VexDay Proof

TestLink 1.9.11 - Multiple SQL Injections

CVE-2014-5308—webappsphp02 Oct 2014

Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL comm

23RISK

Exploit-DB

Epicor Enterprise 7.4 - Multiple Vulnerabilities

CVE-2014-4312—webappsasp02 Oct 2014

Multiple cross-site scripting (XSS) vulnerabilities in Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allow remote

23RISK

Exploit-DB✓ VexDay Proof

Pure-FTPd - External Authentication Bash Environment Variable Code Injection (Metasploit)

CVE-2014-7196—remotelinux02 Oct 2014

20RISK

Exploit-DB

GNU bash 4.3.11 - Environment Variable dhclient

CVE-2014-7186—remotelinux02 Oct 2014

The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial o

35RISK

Exploit-DB✓ VexDay Proof

HP Network Node Manager I - PMD Buffer Overflow (Metasploit)

CVE-2014-2624—remotelinux02 Oct 2014

Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x, 9.1x, and 9.2x allows remote attackers to execute ar

50RISK

Exploit-DB

GNU bash 4.3.11 - Environment Variable dhclient

CVE-2014-7169CRITICALunder attackremotelinux02 Oct 2014

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

100RISK

Exploit-DB

GNU bash 4.3.11 - Environment Variable dhclient

CVE-2014-6278HIGHunder attackremotelinux02 Oct 2014

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi

100RISK

Exploit-DB✓ VexDay Proof

Pure-FTPd - External Authentication Bash Environment Variable Code Injection (Metasploit)

CVE-2014-3659—remotelinux02 Oct 2014

20RISK

Exploit-DB✓ VexDay Proof

Pure-FTPd - External Authentication Bash Environment Variable Code Injection (Metasploit)

CVE-2014-7910—remotelinux02 Oct 2014

Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service o

23RISK

Exploit-DB✓ VexDay Proof

ManageEngine OpManager / Social IT - Arbitrary File Upload (Metasploit)

CVE-2014-6034—remotejava02 Oct 2014

Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in Z

60RISK

Exploit-DB

GNU bash 4.3.11 - Environment Variable dhclient

CVE-2014-7187—remotelinux02 Oct 2014

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers t

35RISK

Exploit-DB

GNU bash 4.3.11 - Environment Variable dhclient

CVE-2014-7196—remotelinux02 Oct 2014

20RISK

Exploit-DB✓ VexDay Proof

Kolibri WebServer 2.0 - Remote Buffer Overflow (EMET 5.0 / EMET 4.1 Partial Bypass)

CVE-2014-5289—remotewindows02 Oct 2014

Buffer overflow in Senkas Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a POST request

28RISK

Exploit-DB✓ VexDay Proof

Pure-FTPd - External Authentication Bash Environment Variable Code Injection (Metasploit)

CVE-2014-3671—remotelinux02 Oct 2014

20RISK

Exploit-DB✓ VexDay Proof

TeamSpeak Client 3.0.14 - Buffer Overflow

CVE-2014-7221—doswindows02 Oct 2014

TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (buffer overflow and

28RISK

Exploit-DB

GNU bash 4.3.11 - Environment Variable dhclient

CVE-2014-3671—remotelinux02 Oct 2014

20RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.