Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,899cataloged exploits
40,392CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
VM Turbo Operations Manager 4.5x - Directory Traversal
CVE-2014-3806—webappscgi12 May 2014
Directory traversal vulnerability in cgi-bin/help/doIt.cgi in VMTurbo Operations Manager before 4.6 allows remote attack
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Yokogawa CS3000 - 'BKESimmgr.exe' Remote Buffer Overflow (Metasploit)
CVE-2014-0782—remotewindows12 May 2014
Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow
68RISK
open ↗
Exploit-DB✓ VexDay Proof
GOM Player 2.2.57.5189 - '.ogg' Crash (PoC)
CVE-2014-3216—doswindows12 May 2014
GOM Media Player 2.2.57.5189 and earlier allows remote attackers to cause a denial of service (crash) via a crafted .ogg
23RISK
open ↗
Exploit-DB✓ VexDay Proof
JetAudio 8.1.1 - '.ogg' Crash (PoC)
CVE-2014-3443—doswindows12 May 2014
JetMPAd.ax in JetAudio 8.1.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted .ogg
23RISK
open ↗
Exploit-DB
Skybox Security 6.3.x < 6.4.x - Multiple Denial of Service Vulnerabilities
CVE-2014-2085—doshardware12 May 2014
20RISK
open ↗
Exploit-DB
Skybox Security 6.3.x < 6.4.x - Multiple Denial of Service Vulnerabilities
CVE-2014-2084—doshardware12 May 2014
Skybox View Appliances with ISO 6.3.33-2.14, 6.3.31-2.14, 6.4.42-2.54, 6.4.45-2.56, and 6.4.46-2.57 does not properly re
23RISK
open ↗
Exploit-DB
Alienvault Open Source SIEM (OSSIM) 4.6.1 - (Authenticated) SQL Injection (Metasploit)
CVE-2014-5383—webappsphp12 May 2014
SQL injection vulnerability in AlienVault OSSIM before 4.7.0 allows remote authenticated users to execute arbitrary SQL
43RISK
open ↗
Exploit-DB✓ VexDay Proof
EFS Easy Chat Server 3.1 - Remote Stack Buffer Overflow
CVE-2004-2466—remotewindows12 May 2014
chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service (server crash) via a long username
60RISK
open ↗
Exploit-DB✓ VexDay Proof
VideoLAN VLC Media Player 2.1.3 - '.wav' File Memory Corruption
CVE-2014-3441—dosmultiple09 May 2014
codec\libpng_plugin.dll in VideoLAN VLC Media Player 2.1.3 allows remote attackers to cause a denial of service (crash)
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Collabtive 1.2 - Persistent Cross-Site Scripting
CVE-2014-3247—webappsphp08 May 2014
Cross-site scripting (XSS) vulnerability in Collabtive 1.2 allows remote authenticated users to inject arbitrary web scr
23RISK
open ↗
Exploit-DB
Cobbler 2.4.x < 2.6.x - Local File Inclusion
CVE-2014-3225—webappsphp08 May 2014
Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated us
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Collabtive 1.2 - SQL Injection
CVE-2014-3246—webappsphp08 May 2014
SQL injection vulnerability in Collabtive 1.2 allows remote authenticated users to execute arbitrary SQL commands via th
23RISK
open ↗
Exploit-DB✓ VexDay Proof
TOA - Cross-Site Request Forgery
CVE-2014-2989—webappsphp08 May 2014
Cross-site request forgery (CSRF) vulnerability in Open Assessment Technologies TAO 2.5.6 allows remote attackers to hij
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Foscam IP Camera - Predictable Credentials Security Bypass
CVE-2014-1849—remotehardware08 May 2014
Foscam IP camera 11.37.2.49 and other versions, when using the Foscam DynDNS option, generates credentials based on pred
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Caldera - '/costview2/printers.php?tr' SQL Injection
CVE-2014-2934—webappsphp07 May 2014
Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Caldera - '/costview2/jobs.php?tr' SQL Injection
CVE-2014-2934—webappsphp07 May 2014
Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows - NTUserMessageCall Win32k Kernel Pool Overflow 'schlamperei.x86.dll' (MS13-053) (Metasploit)
CVE-2013-1300—localwindows_x8606 May 2014
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, W
43RISK
open ↗
Exploit-DB✓ VexDay Proof
Adobe Flash Player - Integer Underflow Remote Code Execution (Metasploit)
CVE-2014-0497HIGHunder attackremotewindows06 May 2014
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
100RISK
open ↗
Exploit-DB✓ VexDay Proof
Apache Struts - ClassLoader Manipulation Remote Code Execution (Metasploit)
CVE-2014-0112—remotemultiple02 May 2014
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which all
60RISK
open ↗
Exploit-DB
F5 BIG-IQ 4.1.0.2013.0 - Privilege Escalation (Metasploit)
CVE-2014-3220—remotehardware02 May 2014
F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary u
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Apache Struts - ClassLoader Manipulation Remote Code Execution (Metasploit)
CVE-2014-0113—remotemultiple02 May 2014
CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict
45RISK
open ↗
Exploit-DB✓ VexDay Proof
Apache Struts - ClassLoader Manipulation Remote Code Execution (Metasploit)
CVE-2014-0094—remotemultiple02 May 2014
The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via t
60RISK
open ↗
Exploit-DB
F5 BIG-IQ 4.1.0.2013.0 - Privilege Escalation (Metasploit)
CVE-2014-2937—remotehardware02 May 2014
20RISK
open ↗
Exploit-DB
Fritz!Box - Remote Command Execution
CVE-2014-9727—webappshardware01 May 2014
AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter t
60RISK
open ↗
Exploit-DB
Beetel 450TC2 Router - Cross-Site Request Forgery (Admin Password)
CVE-2014-3792—webappshardware30 Apr 2014
Cross-site request forgery (CSRF) vulnerability in Beetel 450TC2 Router with firmware TX6-0Q-005_retail allows remote at
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Adobe Flash Player - Type Confusion Remote Code Execution (Metasploit)
CVE-2013-5331—remotewindows29 Apr 2014
Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2
60RISK
open ↗
Exploit-DB
WordPress Plugin iMember360 3.8.012 < 3.9.001 - Multiple Vulnerabilities
CVE-2014-3849—webappsphp28 Apr 2014
The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attac
23RISK
open ↗
Exploit-DB
WordPress Plugin iMember360 3.8.012 < 3.9.001 - Multiple Vulnerabilities
CVE-2014-8948—webappsphp28 Apr 2014
Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows re
23RISK
open ↗
Exploit-DB
WordPress Plugin iMember360 3.8.012 < 3.9.001 - Multiple Vulnerabilities
CVE-2014-8949—webappsphp28 Apr 2014
The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitr
23RISK
open ↗
Exploit-DB
WordPress Plugin iMember360 3.8.012 < 3.9.001 - Multiple Vulnerabilities
CVE-2014-3848—webappsphp28 Apr 2014
The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to o
23RISK
open ↗
← previouspage 230 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.