Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,526cataloged exploits
34,478CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,534GitHub PoC 13,654VulnCheck XDB 8,213Nuclei 4,218Metasploit 3,464✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB✓ VexDay Proof
Bash - 'Shellshock' Environment Variables Command Injection
CVE-2014-7227—remotelinux25 Sep 2014
20RISK
open ↗
Exploit-DB✓ VexDay Proof
GNU Bash - 'Shellshock' Environment Variable Command Injection
CVE-2014-7227—remotelinux25 Sep 2014
20RISK
open ↗
Exploit-DB
webEdition 6.3.8.0 (SVN-Revision: 6985) - Directory Traversal
CVE-2014-5258—webappsphp24 Sep 2014
Directory traversal vulnerability in showTempFile.php in webEdition CMS before 6.3.9.0 Beta allows remote authenticated
43RISK
open ↗
Exploit-DB✓ VexDay Proof
EMC AlphaStor Device Manager Opcode 0x75 - Command Injection (Metasploit)
CVE-2013-0928—remotewindows24 Sep 2014
The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Advantech Webaccess - dvs.ocx GetColor Buffer Overflow (Metasploit)
CVE-2014-2364—remotewindows24 Sep 2014
Advantech WebAccess Stack-Based Buffer Overflow
68RISK
open ↗
Exploit-DB
Restaurant Script (PizzaInn Project) - Persistent Cross-Site Scripting
CVE-2014-6619—webappsphp24 Sep 2014
Multiple cross-site scripting (XSS) vulnerabilities in register-exec.php in Restaurant Script (PizzaInn_Project) 1.0.0 a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
LittleSite 0.1 - 'index.php' Local File Inclusion
CVE-2009-3542—webappsphp23 Sep 2014
Directory traversal vulnerability in ls.php in LittleSite (aka LS or LittleSite.php) 0.1 allows remote attackers to incl
23RISK
open ↗
Exploit-DB
M/Monit 3.3.2 - Cross-Site Request Forgery
CVE-2014-6409—webappsphp20 Sep 2014
Cross-site request forgery (CSRF) vulnerability in M/Monit 3.3.2 and earlier allows remote attackers to hijack the authe
23RISK
open ↗
Exploit-DB
M/Monit 3.3.2 - Cross-Site Request Forgery
CVE-2014-6607—webappsphp20 Sep 2014
M/Monit 3.3.2 and earlier does not verify the original password before changing passwords, which allows remote attackers
23RISK
open ↗
Exploit-DB
ClassApps SelectSurvey.net - Multiple SQL Injections
CVE-2014-6030—webappsphp20 Sep 2014
Multiple SQL injection vulnerabilities in ClassApps SelectSurvey.NET before 4.125.002 allow (1) remote attackers to exec
23RISK
open ↗
Exploit-DB
Livefyre LiveComments Plugin - Persistent Cross-Site Scripting
CVE-2014-6420—webappsphp20 Sep 2014
Cross-site scripting (XSS) vulnerability in Livefyre LiveComments 3.0 allows remote attackers to inject arbitrary web sc
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin Slideshow Gallery 1.4.6 - Arbitrary File Upload
CVE-2014-5460—webappsphp16 Sep 2014
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remot
60RISK
open ↗
Exploit-DB✓ VexDay Proof
Railo 4.2.1 - Remote File Inclusion (Metasploit)
CVE-2014-5468—remotemultiple15 Sep 2014
A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cf
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (1)
CVE-2014-6287CRITICALunder attackremotewindows15 Sep 2014
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗
Exploit-DB✓ VexDay Proof
Aztech Modem Routers - Information Disclosure
CVE-2014-6437—remotehardware15 Sep 2014
Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices allow remote attackers to obtain sensitive device configurat
28RISK
open ↗
Exploit-DB✓ VexDay Proof
ManageEngine Eventlog Analyzer - Arbitrary File Upload (Metasploit)
CVE-2014-6037—remotemultiple15 Sep 2014
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8
60RISK
open ↗
Exploit-DB✓ VexDay Proof
Aztech Modem Routers - Session Hijacking
CVE-2014-6436—remotehardware15 Sep 2014
Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices improperly manage sessions, which allows remote attackers to
35RISK
open ↗
Exploit-DB✓ VexDay Proof
Aztech Routers - '/cgi-bin/AZ_Retrain.cgi' Denial of Service
CVE-2014-6435—doshardware15 Sep 2014
cgi-bin/AZ_Retrain.cgi in Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices does not check for authentication,
28RISK
open ↗
Exploit-DB
CacheGuard-OS 5.7.7 - Cross-Site Request Forgery
CVE-2014-4865—webappslinux15 Sep 2014
Cross-site request forgery (CSRF) vulnerability in gui/password-wadmin.apl in CacheGuard OS 5.7.7 allows remote attacker
23RISK
open ↗
Exploit-DB✓ VexDay Proof
ManageEngine Desktop Central StatusUpdate - Arbitrary File Upload (Metasploit)
CVE-2014-5006—remotewindows09 Sep 2014
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers
28RISK
open ↗
Exploit-DB✓ VexDay Proof
ManageEngine Desktop Central StatusUpdate - Arbitrary File Upload (Metasploit)
CVE-2014-5005—remotewindows09 Sep 2014
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers
60RISK
open ↗
Exploit-DB
phpMyFAQ 2.8.x - Multiple Vulnerabilities
CVE-2014-6046—webappsphp08 Sep 2014
Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack th
23RISK
open ↗
Exploit-DB
Mpay24 PrestaShop Payment Module 1.5 - Multiple Vulnerabilities
CVE-2014-2008—webappsphp08 Sep 2014
SQL injection vulnerability in confirm.php in the mPAY24 payment module before 1.6 for PrestaShop allows remote attacker
23RISK
open ↗
Exploit-DB
phpMyFAQ 2.8.x - Multiple Vulnerabilities
CVE-2014-6045—webappsphp08 Sep 2014
SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to exec
23RISK
open ↗
Exploit-DB
Mpay24 PrestaShop Payment Module 1.5 - Multiple Vulnerabilities
CVE-2014-2009—webappsphp08 Sep 2014
The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path
23RISK
open ↗
Exploit-DB
phpMyFAQ 2.8.x - Multiple Vulnerabilities
CVE-2014-6047—webappsphp08 Sep 2014
phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by lever
23RISK
open ↗
Exploit-DB
phpMyFAQ 2.8.x - Multiple Vulnerabilities
CVE-2014-6048—webappsphp08 Sep 2014
phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request.
23RISK
open ↗
Exploit-DB
phpMyFAQ 2.8.x - Multiple Vulnerabilities
CVE-2014-6050—webappsphp08 Sep 2014
phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request.
23RISK
open ↗
Exploit-DB
phpMyFAQ 2.8.x - Multiple Vulnerabilities
CVE-2014-6049—webappsphp08 Sep 2014
phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted ins
23RISK
open ↗
Exploit-DB
LoadedCommerce7 - Systemic Query Factory
CVE-2014-5140—webappsphp07 Sep 2014
The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly ha
23RISK
open ↗
← previouspage 217 / 815next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.