Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,989cataloged exploits
40,450CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,042VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
Huawei Technologies du Mobile Broadband 16.0 - Local Privilege Escalation
CVE-2014-8359—localwindows24 Dec 2013
Untrusted search path vulnerability in Huawei Mobile Partner for Windows 23.009.05.03.1014 allows local users to execute
23RISK
open ↗
Exploit-DB✓ VexDay Proof
HP SiteScope issueSiebelCmd - Remote Code Execution (Metasploit)
CVE-2013-4835—remoteunix24 Dec 2013
The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authenti
60RISK
open ↗
Exploit-DB✓ VexDay Proof
Zimbra Collaboration Server 7.2.2/8.0.2 - Local File Inclusion (Metasploit)
CVE-2013-7091—webappslinux24 Dec 2013
Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zim
60RISK
open ↗
Exploit-DB✓ VexDay Proof
RealNetworks RealPlayer 16.0.3.51/16.0.2.32 - '.rmp' Version Attribute Buffer Overflow
CVE-2013-7260—localwindows24 Dec 2013
Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before
50RISK
open ↗
Exploit-DB
Cisco EPC3925 - Persistent Cross-Site Scripting
CVE-2013-6976—webappshardware21 Dec 2013
Cross-site request forgery (CSRF) vulnerability in goform/Quick_setup on Cisco EPC3925 devices allows remote attackers t
23RISK
open ↗
Exploit-DB
GOM Player 2.2.56.5158 - '.avi' File Handling Memory Corruption
CVE-2013-7184—doswindows20 Dec 2013
Gretech GOM Media Player 2.2.56.5158 and earlier allows remote attackers to cause a denial of service (memory corruption
23RISK
open ↗
Exploit-DB
PotPlayer 1.5.40688 - '.avi' File Handling Memory Corruption
CVE-2013-7185—doswindows20 Dec 2013
PotPlayer 1.5.40688: .avi File Memory Corruption
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Hancom Office - '.hml' File Processing Heap Buffer Overflow
CVE-2013-7420—remotewindows19 Dec 2013
Buffer overflow in Hancom Office 2010 SE allows remote attackers to execute arbitrary via a long string in the Text attr
23RISK
open ↗
Exploit-DB✓ VexDay Proof
DenyHosts - 'regex.py' Remote Denial of Service
CVE-2013-6890—doslinux19 Dec 2013
denyhosts 2.6 uses an incorrect regular expression when analyzing authentication logs, which allows remote attackers to
23RISK
open ↗
Exploit-DB
Jenkins 1.523 - Persistent HTML Code
CVE-2013-5573—webappsphp18 Dec 2013
Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inj
23RISK
open ↗
Exploit-DB
SonarQube Jenkins Plugin - Plain Text Password
CVE-2013-5676—webappsphp18 Dec 2013
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (clea
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Leed - 'id' SQL Injection
CVE-2013-2627—webappsphp18 Dec 2013
SQL injection vulnerability in action.php in Leed (Light Feed), possibly before 1.5 Stable, allows remote attackers to e
23RISK
open ↗
Exploit-DB
Ditto Forensic FieldStation 2013Oct15a - Multiple Vulnerabilities
CVE-2013-6884—webappsphp17 Dec 2013
The write-blocker in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a has a default "ditto" username and
28RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Core 2.0.11 - '/wp-admin/options-discussion.php' Script Cross-Site Request Forgery
CVE-2013-7233—webappsphp17 Dec 2013
Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPre
23RISK
open ↗
Exploit-DB
Ditto Forensic FieldStation 2013Oct15a - Multiple Vulnerabilities
CVE-2013-6881—webappsphp17 Dec 2013
CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands vi
28RISK
open ↗
Exploit-DB
Ditto Forensic FieldStation 2013Oct15a - Multiple Vulnerabilities
CVE-2013-6882—webappsphp17 Dec 2013
Multiple cross-site scripting (XSS) vulnerabilities in CRU Ditto Forensic FieldStation with firmware 2013Oct15a and earl
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting
CVE-2013-6162—remotewindows17 Dec 2013
Cross-site scripting (XSS) vulnerability in Code-Crafters Ability Mail Server 3.1.1 allows remote attackers to inject ar
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Adobe Reader ToolButton - Use-After-Free (Metasploit)
CVE-2013-3346HIGHunder attackremotewindows17 Dec 2013
Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitr
100RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows Kernel - 'win32k.sys' Integer Overflow (MS13-101)
CVE-2013-5058—doswindows17 Dec 2013
Integer overflow in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista
23RISK
open ↗
Exploit-DB
PHP - 'openssl_x509_parse()' Memory Corruption
CVE-2013-6420—dosphp17 Dec 2013
The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.
35RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows - 'ndproxy.sys' Local Privilege Escalation (Metasploit)
CVE-2013-5065HIGHunder attacklocalwindows17 Dec 2013
NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges
98RISK
open ↗
Exploit-DB
Ditto Forensic FieldStation 2013Oct15a - Multiple Vulnerabilities
CVE-2013-6883—webappsphp17 Dec 2013
Cross-site request forgery (CSRF) vulnerability in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allow
23RISK
open ↗
Exploit-DB
InstantCMS 1.10.3 - Blind SQL Injection
CVE-2013-6839—webappsphp17 Dec 2013
SQL injection vulnerability in InstantSoft InstantCMS 1.10.3 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Nvidia (nvsvc) Display Driver Service - Local Privilege Escalation (Metasploit)
CVE-2013-0109—localwindows_x86-6417 Dec 2013
The NVIDIA driver before 307.78, and Release 310 before 311.00, in the NVIDIA Display Driver service on Windows does not
38RISK
open ↗
Exploit-DB
QuickHeal AntiVirus 7.0.0.1 - Local Stack Overflow
CVE-2013-6767—localwindows17 Dec 2013
Stack-based buffer overflow in pepoly.dll in Quick Heal AntiVirus Pro 7.0.0.1 allows local users to execute arbitrary co
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Icinga - cgi/config.c process_cgivars Function Off-by-One Read Remote Denial of Service
CVE-2013-7108—doscgi16 Dec 2013
Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10
35RISK
open ↗
Exploit-DB✓ VexDay Proof
Gitlab 6.0 - Persistent Cross-Site Scripting
CVE-2013-7316—webappsphp16 Dec 2013
Cross-site scripting (XSS) vulnerability in GitLab 6.0 and other versions before 6.5.0 allows remote attackers to inject
23RISK
open ↗
Exploit-DB✓ VexDay Proof
C2C Forward Auction Creator - '/auction/casp/Admin.asp' SQL Injection (Admin Authentication Bypass)
CVE-2013-7193—webappsphp16 Dec 2013
Multiple SQL injection vulnerabilities in C2C Forward Auction Creator 2.0 allow remote attackers to execute arbitrary SQ
23RISK
open ↗
Exploit-DB
UPC Ireland Cisco EPC 2425 Router / Horizon Box - WPA-PSK Handshake Information
CVE-2013-7136—webappshardware16 Dec 2013
The UPC Ireland Cisco EPC 2425 router (aka Horizon Box) does not have a sufficiently large number of possible WPA-PSK pa
23RISK
open ↗
Exploit-DB
Cisco EPC3925 - Cross-Site Request Forgery
CVE-2013-6976—webappshardware16 Dec 2013
Cross-site request forgery (CSRF) vulnerability in goform/Quick_setup on Cisco EPC3925 devices allows remote attackers t
23RISK
open ↗
← previouspage 241 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.