Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,899cataloged exploits
40,392CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
WordPress Plugin Disqus 2.7.5 - Cross-Site Request Forgery (Admin Persistent) / Cross-Site Scripting
CVE-2014-5346—webappsphp14 Aug 2014
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow
23RISK
open ↗
Exploit-DB
VMTurbo Operations Manager 4.6 - 'vmtadmin.cgi' Remote Command Execution (Metasploit)
CVE-2014-5073—remotelinux14 Aug 2014
vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands
60RISK
open ↗
Exploit-DB✓ VexDay Proof
Oracle VM VirtualBox Guest Additions 4.3.10r93012 - 'VBoxGuest.sys' Local Privilege Escalation (Metasploit)
CVE-2014-2477—localwindows13 Aug 2014
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.2
38RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin GB Gallery Slideshow - '/wp-admin/admin-ajax.php' SQL Injection
CVE-2014-8375—webappsphp11 Aug 2014
SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administ
23RISK
open ↗
Exploit-DB
TomatoCart 1.x - SQL Injection
CVE-2014-3978—webappsphp09 Aug 2014
SQL injection vulnerability in TomatoCart 1.1.8.6.1 allows remote authenticated users to execute arbitrary SQL commands
23RISK
open ↗
Exploit-DB
Pro Chat Rooms 8.2.0 - Multiple Vulnerabilities
CVE-2014-5275—webappsphp06 Aug 2014
Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote au
23RISK
open ↗
Exploit-DB
Pro Chat Rooms 8.2.0 - Multiple Vulnerabilities
CVE-2014-5276—webappsphp06 Aug 2014
Multiple cross-site scripting (XSS) vulnerabilities in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated u
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Symantec Endpoint Protection 11.x/12.x - Kernel Pool Overflow / Local Privilege Escalation
CVE-2014-3434—localwindows05 Aug 2014
Buffer overflow in the sysplant driver in Symantec Endpoint Protection (SEP) Client 11.x and 12.x before 12.1 RU4 MP1b,
23RISK
open ↗
Exploit-DB
Sphider Search Engine - Multiple Vulnerabilities
CVE-2014-5082—webappsphp02 Aug 2014
Multiple SQL injection vulnerabilities in admin/admin.php in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus al
23RISK
open ↗
Exploit-DB
Status2k Server Monitoring Software - Multiple Vulnerabilities
CVE-2014-5090—webappsphp02 Aug 2014
admin/options/logs.php in Status2k allows remote authenticated administrators to execute arbitrary commands via shell me
23RISK
open ↗
Exploit-DB
Sphider Search Engine - Multiple Vulnerabilities
CVE-2014-5083—webappsphp02 Aug 2014
A Command Execution vulnerability exists in Sphider before 1.3.6 due to insufficient sanitization of fwrite to conf.php,
23RISK
open ↗
Exploit-DB
Sphider Search Engine - Multiple Vulnerabilities
CVE-2014-5086—webappsphp02 Aug 2014
A Command Execution vulnerability exists in Sphider Pro, and Sphider Plus 3.2 due to insufficient sanitization of fwrite
23RISK
open ↗
Exploit-DB
Sphider Search Engine - Multiple Vulnerabilities
CVE-2014-5085—webappsphp02 Aug 2014
A Command Execution vulnerability exists in Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, whi
23RISK
open ↗
Exploit-DB
Sphider Search Engine - Multiple Vulnerabilities
CVE-2014-5087—webappsphp02 Aug 2014
A vulnerability exists in Sphider Search Engine prior to 1.3.6 due to exec calls in admin/spiderfuncs.php, which could l
23RISK
open ↗
Exploit-DB
Status2k Server Monitoring Software - Multiple Vulnerabilities
CVE-2014-5094—webappsphp02 Aug 2014
Status2k allows remote attackers to obtain configuration information via a phpinfo action in a request to status/index.p
23RISK
open ↗
Exploit-DB
Status2k Server Monitoring Software - Multiple Vulnerabilities
CVE-2014-5092—webappsphp02 Aug 2014
Status2k allows Remote Command Execution in admin/options/editpl.php.
23RISK
open ↗
Exploit-DB
Status2k Server Monitoring Software - Multiple Vulnerabilities
CVE-2014-5088—webappsphp02 Aug 2014
Cross-site scripting (XSS) vulnerability in Status2k allows remote attackers to inject arbitrary web script or HTML via
23RISK
open ↗
Exploit-DB
Sphider Search Engine - Multiple Vulnerabilities
CVE-2014-5084—webappsphp02 Aug 2014
A Command Execution vulnerability exists in Sphider Pro 3.2 due to insufficient sanitization of fwrite, which could let
23RISK
open ↗
Exploit-DB
Status2k Server Monitoring Software - Multiple Vulnerabilities
CVE-2014-5089—webappsphp02 Aug 2014
SQL injection vulnerability in admin/options/logs.php in Status2k allows remote authenticated administrators to execute
23RISK
open ↗
Exploit-DB
Status2k Server Monitoring Software - Multiple Vulnerabilities
CVE-2014-5091—webappsphp02 Aug 2014
A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, wh
28RISK
open ↗
Exploit-DB
Status2k Server Monitoring Software - Multiple Vulnerabilities
CVE-2014-5093—webappsphp02 Aug 2014
Status2k does not remove the install directory allowing credential reset.
23RISK
open ↗
Exploit-DB
ArticleFR 11.06.2014 - 'data.php' Privilege Escalation
CVE-2014-4170—webappsphp02 Aug 2014
A Privilege Escalation Vulnerability exists in Free Reprintables ArticleFR 11.06.2014 due to insufficient access restric
28RISK
open ↗
Exploit-DB
D-Link DWR-113 Rev. Ax - Cross-Site Request Forgery / Denial of Service
CVE-2014-3136—doshardware30 Jul 2014
Cross-site request forgery (CSRF) vulnerability in D-Link DWR-113 (Rev. Ax) with firmware before 2.03b02 allows remote a
23RISK
open ↗
Exploit-DB
Oxwall 1.7.0 - Multiple Cross-Site Request Forgery / HTML Injection Vulnerabilities
CVE-2014-9101—webappsphp28 Jul 2014
Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall 1.7.0 (build 7907 and 7906) and SkaDate Lite 2.0 (b
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin FB Gorilla - 'game_play.php' SQL Injection
CVE-2014-5200—webappsphp28 Jul 2014
SQL injection vulnerability in game_play.php in the FB Gorilla plugin for WordPress allows remote attackers to execute a
23RISK
open ↗
Exploit-DB
Ubiquiti UbiFi / mFi / AirVision - Cross-Site Request Forgery
CVE-2014-2225—webappshardware28 Jul 2014
Multiple cross-site request forgery (CSRF) vulnerabilities in Ubiquiti Networks UniFi Controller before 3.2.1 allow remo
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Sphider Search Engine 1.3.6 - Multiple Vulnerabilities
CVE-2014-5082—webappsphp28 Jul 2014
Multiple SQL injection vulnerabilities in admin/admin.php in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus al
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Sphider Search Engine 1.3.6 - Multiple Vulnerabilities
CVE-2014-5193—webappsphp28 Jul 2014
Cross-site scripting (XSS) vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to inject arbitrary
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin WhyDoWork AdSense - 'options-general.php' Cross-Site Request Forgery (Option Manipulation)
CVE-2014-9099—webappsphp28 Jul 2014
Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attacker
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin Lead Octopus Power - 'id' SQL Injection
CVE-2014-5189—webappsphp28 Jul 2014
SQL injection vulnerability in lib/optin/optin_page.php in the Lead Octopus plugin for WordPress allows remote attackers
23RISK
open ↗
← previouspage 221 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.