Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,899cataloged exploits
40,392CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB✓ VexDay Proof
Wireshark 1.8.12/1.10.5 - wiretap/mpeg.c Stack Buffer Overflow (Metasploit)
CVE-2014-2299—localwindows28 Apr 2014
Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10
50RISK
open ↗
Exploit-DB
WordPress Plugin iMember360 3.8.012 < 3.9.001 - Multiple Vulnerabilities
CVE-2014-3849—webappsphp28 Apr 2014
The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attac
23RISK
open ↗
Exploit-DB
McAfee ePolicy Orchestrator 4.6.0 < 4.6.5 - 'ePowner' Multiple Vulnerabilities
CVE-2013-0140—remotewindows28 Apr 2014
SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x b
23RISK
open ↗
Exploit-DB
WordPress Plugin iMember360 3.8.012 < 3.9.001 - Multiple Vulnerabilities
CVE-2014-3848—webappsphp28 Apr 2014
The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to o
23RISK
open ↗
Exploit-DB
WordPress Plugin iMember360 3.8.012 < 3.9.001 - Multiple Vulnerabilities
CVE-2014-3842—webappsphp28 Apr 2014
Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow
23RISK
open ↗
Exploit-DB
GeoCore MAX DB Ver. 7.3.3 - Blind SQL Injection
CVE-2014-3871—webappsphp28 Apr 2014
Multiple SQL injection vulnerabilities in register.php in Geodesic Solutions GeoCore MAX 7.3.3 (formerly GeoClassifieds
23RISK
open ↗
Exploit-DB
Symantec Endpoint Protection Manager 12.1.x - Overflow (SEH) (PoC)
CVE-2013-1612—doswindows27 Apr 2014
Buffer overflow in secars.dll in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1.x before 12.
23RISK
open ↗
Exploit-DB
miSecureMessages 4.0.1 - Session Management / Authentication Bypass
CVE-2014-2347—webappsmultiple25 Apr 2014
AMTELCO miSecure Information Exposure
41RISK
open ↗
Exploit-DB✓ VexDay Proof
Kolibri Web Server 2.0 - GET Stack Buffer Overflow
CVE-2014-4158—remotewindows25 Apr 2014
Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a GET req
28RISK
open ↗
Exploit-DB✓ VexDay Proof
dompdf 0.6.0 - 'dompdf.php?read' Arbitrary File Read
CVE-2014-2383—webappsphp24 Apr 2014
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroo
50RISK
open ↗
Exploit-DB✓ VexDay Proof
OpenSSL TLS Heartbeat Extension - 'Heartbleed' Information Leak (2) (DTLS Support)
CVE-2014-0346—remotemultiple24 Apr 2014
20RISK
open ↗
Exploit-DB
WD Arkeia Virtual Appliance 10.2.9 - Local File Inclusion
CVE-2014-2846—webappsphp24 Apr 2014
Directory traversal vulnerability in opt/arkeia/wui/htdocs/index.php in the WD Arkeia virtual appliance (AVA) with firmw
23RISK
open ↗
Exploit-DB
Acunetix 8 build 20120704 - Remote Stack Overflow
CVE-2014-2994—remotewindows24 Apr 2014
Stack-based buffer overflow in Acunetix Web Vulnerability Scanner (WVS) 8 build 20120704 allows remote attackers to exec
28RISK
open ↗
Exploit-DB✓ VexDay Proof
OpenSSL TLS Heartbeat Extension - 'Heartbleed' Information Leak (2) (DTLS Support)
CVE-2014-0160HIGHunder attackremotemultiple24 Apr 2014
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RISK
open ↗
Exploit-DB
HP Laser Jet - JavaScript Persistent Cross-Site Scripting via PJL Directory Traversal
CVE-2010-4107—webappshardware23 Apr 2014
The default configuration of the PJL Access value in the File System External Access settings on HP LaserJet MFP printer
28RISK
open ↗
Exploit-DB
kitForm CRM Extension 0.43 - 'sorter.ph?sorter_value' SQL Injection
CVE-2014-3757—webappsphp22 Apr 2014
SQL injection vulnerability in sorter.php in the phpManufaktur kitForm extension 0.43 and earlier for the KeepInTouch (K
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple Mac OSX - Local Security Bypass
CVE-2014-1322—localosx22 Apr 2014
The kernel in Apple OS X through 10.9.2 places a kernel pointer into an XNU object data structure accessible from user s
23RISK
open ↗
Exploit-DB
Sixnet Sixview 2.4.1 - Web Console Directory Traversal
CVE-2014-2976—webappshardware22 Apr 2014
Directory traversal vulnerability in Sixnet SixView Manager 2.4.1 allows remote attackers to read arbitrary files via a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Adobe Flash Player - Regular Expression Heap Overflow (Metasploit)
CVE-2013-0633—remotewindows21 Apr 2014
Buffer overflow in Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Adobe Flash Player - Regular Expression Heap Overflow (Metasploit)
CVE-2013-0634—remotewindows21 Apr 2014
Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x
60RISK
open ↗
Exploit-DB
Teracom Modem T2-B-Gawv1.4U10Y-BI - Cross-Site Request Forgery
CVE-2014-10019—webappshardware20 Apr 2014
Multiple cross-site request forgery (CSRF) vulnerabilities in webconfig/wlan/country.html/country in the Teracom T2-B-Ga
23RISK
open ↗
Exploit-DB
Linux Kernel - 'group_info' refcounter Overflow Memory Corruption
CVE-2014-2851—doslinux18 Apr 2014
Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users
23RISK
open ↗
Exploit-DB
NRPE 2.15 - Remote Command Execution
CVE-2014-2913—remotemultiple18 Apr 2014
Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote atta
28RISK
open ↗
Exploit-DB✓ VexDay Proof
SAP Router - Timing Attack Password Disclosure
CVE-2014-0984—remotehardware17 Apr 2014
The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Jzip - Buffer Overflow (PoC) (SEH Unicode)
CVE-2010-5300—doswindows16 Apr 2014
Stack-based buffer overflow in Jzip 1.3 through 2.0.0.132900 allows remote attackers to cause a denial of service (crash
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer - CMarkup Use-After-Free (MS14-012) (Metasploit)
CVE-2014-0322HIGHunder attackremotewindows16 Apr 2014
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code v
100RISK
open ↗
Exploit-DB
Unitrends Enterprise Backup 7.3.0 - Root Remote Code Execution (Metasploit)
CVE-2014-3139—remoteunix15 Apr 2014
recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by s
23RISK
open ↗
Exploit-DB
Xerox DocuShare - SQL Injection
CVE-2014-3138—webappshardware15 Apr 2014
SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1
23RISK
open ↗
Exploit-DB✓ VexDay Proof
lxml - 'clean_html' Security Bypass
CVE-2014-3146MEDIUMremotelinux15 Apr 2014
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct
33RISK
open ↗
Exploit-DB
Unitrends Enterprise Backup 7.3.0 - Root Remote Code Execution (Metasploit)
CVE-2014-3008—remoteunix15 Apr 2014
Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacte
23RISK
open ↗
← previouspage 231 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.