Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,526cataloged exploits
34,478CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,534GitHub PoC 13,654VulnCheck XDB 8,213Nuclei 4,218Metasploit 3,464✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB
PhpOnlineChat 3.0 - Cross-Site Scripting
CVE-2014-100017—webappsphp07 Sep 2014
Cross-site scripting (XSS) vulnerability in canned_opr.php in PhpOnlineChat 3.0 allows remote attackers to inject arbitr
23RISK
open ↗
Exploit-DB✓ VexDay Proof
BulletProof FTP Client 2010 - Buffer Overflow (SEH)
CVE-2014-2973—doswindows05 Sep 2014
35RISK
open ↗
Exploit-DB✓ VexDay Proof
Mozilla Firefox 9.0.1 / Thunderbird 3.1.20 - Information Disclosure
CVE-2014-1564—remotemultiple02 Sep 2014
Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize m
23RISK
open ↗
Exploit-DB
WordPress Plugin Huge-IT Image Gallery 1.0.1 - (Authenticated) SQL Injection
CVE-2014-7153—webappsphp02 Sep 2014
SQL injection vulnerability in the editgallery function in admin/gallery_func.php in the Huge-IT Image Gallery plugin 1.
23RISK
open ↗
Exploit-DB
Syslog LogAnalyzer 3.6.5 - Persistent Cross-Site Scripting
CVE-2014-6070—webappsmultiple02 Sep 2014
Multiple cross-site scripting (XSS) vulnerabilities in Adiscon LogAnalyzer before 3.6.6 allow remote attackers to inject
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Wing FTP Server - (Authenticated) Command Execution (Metasploit)
CVE-2015-4107—remotewindows01 Sep 2014
20RISK
open ↗
Exploit-DB✓ VexDay Proof
Mulitple WordPress Themes - 'admin-ajax.php?img' Arbitrary File Download
CVE-2015-1579—webappsphp01 Sep 2014
Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitra
43RISK
open ↗
Exploit-DB
ManageEngine EventLog Analyzer - Multiple Vulnerabilities (1)
CVE-2014-6043—webappsjsp01 Sep 2014
ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 does not properly restrict access to the database
28RISK
open ↗
Exploit-DB
ManageEngine Desktop Central - Arbitrary File Upload / Remote Code Execution
CVE-2014-5005—webappsjsp01 Sep 2014
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers
60RISK
open ↗
Exploit-DB
WordPress Plugin Slideshow Gallery 1.4.6 - Arbitrary File Upload
CVE-2014-5460—webappsphp01 Sep 2014
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remot
60RISK
open ↗
Exploit-DB✓ VexDay Proof
Mulitple WordPress Themes - 'admin-ajax.php?img' Arbitrary File Download
CVE-2014-9734—webappsphp01 Sep 2014
Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote att
28RISK
open ↗
Exploit-DB
ManageEngine Desktop Central - Arbitrary File Upload / Remote Code Execution
CVE-2014-5007—webappsjsp01 Sep 2014
Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop
35RISK
open ↗
Exploit-DB
ManageEngine Desktop Central - Arbitrary File Upload / Remote Code Execution
CVE-2013-7390—webappsjsp01 Sep 2014
Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before buil
60RISK
open ↗
Exploit-DB
ManageEngine EventLog Analyzer - Multiple Vulnerabilities (1)
CVE-2014-6037—webappsjsp01 Sep 2014
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8
60RISK
open ↗
Exploit-DB
ManageEngine Desktop Central - Arbitrary File Upload / Remote Code Execution
CVE-2014-5006—webappsjsp01 Sep 2014
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers
28RISK
open ↗
Exploit-DB
NRPE 2.15 - Remote Code Execution
CVE-2014-2913—remotemultiple29 Aug 2014
Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote atta
28RISK
open ↗
Exploit-DB
F5 Big-IP - rsync Access
CVE-2014-2927—remotehardware29 Aug 2014
The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Mozilla Firefox - WebIDL Privileged JavaScript Injection (Metasploit)
CVE-2014-1510—remotemultiple28 Aug 2014
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
60RISK
open ↗
Exploit-DB
ManageEngine DeviceExpert 5.9 - User Credential Disclosure
CVE-2014-5377—webappsmultiple28 Aug 2014
ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user acc
50RISK
open ↗
Exploit-DB
XRms - Blind SQL Injection / Command Execution
CVE-2014-5520—webappsphp28 Aug 2014
SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin ShortCode 0.2.3 - Local File Inclusion
CVE-2014-5465—webappsphp28 Aug 2014
Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress
28RISK
open ↗
Exploit-DB
Microsoft Internet Explorer - Memory Corruption (PoC) (MS14-029)
CVE-2014-1815—doswindows28 Aug 2014
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service
28RISK
open ↗
Exploit-DB
XRms - Blind SQL Injection / Command Execution
CVE-2014-5521—webappsphp28 Aug 2014
plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote authenticated users to execute arbitrary co
23RISK
open ↗
Exploit-DB
Plogger 1.0-RC1 - (Authenticated) Arbitrary File Upload
CVE-2014-2223—webappsphp28 Aug 2014
Unrestricted file upload vulnerability in plog-admin/plog-upload.php in Plogger 1.0 RC1 and earlier allows remote authen
28RISK
open ↗
Exploit-DB
PhpWiki - Remote Command Execution
CVE-2014-5519—webappsphp28 Aug 2014
The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a dev
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Mozilla Firefox - WebIDL Privileged JavaScript Injection (Metasploit)
CVE-2014-1511—remotemultiple28 Aug 2014
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
60RISK
open ↗
Exploit-DB✓ VexDay Proof
glibc - NUL Byte gconv_translit_find Off-by-One
CVE-2014-5119—locallinux27 Aug 2014
Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-depe
28RISK
open ↗
Exploit-DB✓ VexDay Proof
VTLS Virtua InfoStation.cgi - SQL Injection
CVE-2014-2081—webappscgi26 Aug 2014
Multiple SQL injection vulnerabilities in the login in web_reports/cgi-bin/InfoStation.cgi in Innovative vtls-Virtua bef
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Granding MA300 - Traffic Sniffing Man In The Middle Fingerprint PIN Disclosure
CVE-2014-5380—remotemultiple26 Aug 2014
Grand MA 300 allows retrieval of the access PIN from sniffed data.
23RISK
open ↗
Exploit-DB
ntopng 1.2.0 - Cross-Site Scripting Injection
CVE-2014-5464—webappsmultiple26 Aug 2014
Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 al
23RISK
open ↗
← previouspage 218 / 815next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.