Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,989cataloged exploits
40,450CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,042VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB✓ VexDay Proof
Nginx 1.1.17 - URI Processing SecURIty Bypass
CVE-2013-4547—remotemultiple19 Nov 2013
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
35RISK
open ↗
Exploit-DB
Avira Secure Backup 1.0.0.1 Build 3616 - '.reg' Buffer Overflow
CVE-2013-6356—doswindows18 Nov 2013
20RISK
open ↗
Exploit-DB
ManageEngine Desktop Central 8.0.0 build < 80293 - Arbitrary File Upload
CVE-2013-7390—webappsjsp18 Nov 2013
Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before buil
60RISK
open ↗
Exploit-DB
Dahua DVR 2.608.0000.0/2.608.GV00.0 - Authentication Bypass (Metasploit)
CVE-2013-6117—webappshardware18 Nov 2013
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive informatio
60RISK
open ↗
Exploit-DB
ManageEngine Desktop Central 8.0.0 build < 80293 - Arbitrary File Upload
CVE-2014-5007—webappsjsp18 Nov 2013
Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop
35RISK
open ↗
Exploit-DB
Dahua DVR 2.608.0000.0/2.608.GV00.0 - Authentication Bypass (Metasploit)
CVE-2013-3614—webappshardware18 Nov 2013
Dahua DVR appliances have a small value for the maximum password length, which makes it easier for remote attackers to o
23RISK
open ↗
Exploit-DB
Dahua DVR 2.608.0000.0/2.608.GV00.0 - Authentication Bypass (Metasploit)
CVE-2013-3613—webappshardware18 Nov 2013
Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access
23RISK
open ↗
Exploit-DB
Dahua DVR 2.608.0000.0/2.608.GV00.0 - Authentication Bypass (Metasploit)
CVE-2013-3612—webappshardware18 Nov 2013
Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which
28RISK
open ↗
Exploit-DB
LiveZilla 5.0.1.4 - Remote Code Execution
CVE-2013-6225—webappsphp18 Nov 2013
LiveZilla 5.0.1.4 has a Remote Code Execution vulnerability
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Supermicro Onboard IPMI - 'close_window.cgi' Remote Buffer Overflow (Metasploit)
CVE-2013-3623—remotehardware18 Nov 2013
Multiple stack-based buffer overflows in cgi/close_window.cgi in the web interface in the Intelligent Platform Managemen
60RISK
open ↗
Exploit-DB
Dahua DVR 2.608.0000.0/2.608.GV00.0 - Authentication Bypass (Metasploit)
CVE-2013-3615—webappshardware18 Nov 2013
Dahua DVR appliances use a password-hash algorithm with a short hash length, which makes it easier for context-dependent
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Watermark Master 2.2.23 - '.wstyle' Local Buffer Overflow (SEH)
CVE-2013-6937—localwindows14 Nov 2013
Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Symantec Altiris DS - SQL Injection (Metasploit)
CVE-2008-2286—remotewindows13 Nov 2013
SQL injection vulnerability in axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 allow
50RISK
open ↗
Exploit-DB
TOSHIBA e-Studio 232/233/282/283 - Cross-Site Request Forgery (Change Admin Password)
CVE-2014-1990—webappshardware13 Nov 2013
Cross-site request forgery (CSRF) vulnerability in TopAccess (aka the web-based management utility) on TOSHIBA TEC e-Stu
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Testa OTMS - Multiple SQL Injections
CVE-2013-6873—webappsphp13 Nov 2013
SQL injection vulnerability in Testa Online Test Management System (OTMS) 2.0.0.2 allows remote attackers to execute arb
23RISK
open ↗
Exploit-DB
Juniper Junos J-Web - Privilege Escalation
CVE-2013-6618—webappsphp12 Nov 2013
jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1 before 12.1R5, 12.2 before 12.2R3,
28RISK
open ↗
Exploit-DB
ALLPlayer 5.6.2 - '.m3u' File Local Buffer Overflow (SEH Unicode)
CVE-2013-7409—localwindows12 Nov 2013
Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possib
50RISK
open ↗
Exploit-DB✓ VexDay Proof
VICIdial Manager - Send OS Command Injection (Metasploit)
CVE-2013-4468—remotelinux08 Nov 2013
VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allows remote authenticated users to execut
50RISK
open ↗
Exploit-DB✓ VexDay Proof
VICIdial Manager - Send OS Command Injection (Metasploit)
CVE-2013-7382—remotelinux08 Nov 2013
VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier has a hardcoded password of donotedit for t
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Vanilla Forums 2.0 < 2.0.18.5 - 'class.utilitycontroller.php' PHP Object Injection
CVE-2013-3528—webappsphp08 Nov 2013
Unspecified vulnerability in the update check in Vanilla Forums before 2.0.18.8 has unspecified impact and remote attack
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Vanilla Forums 2.0 < 2.0.18.5 - 'class.utilitycontroller.php' PHP Object Injection
CVE-2013-2749—webappsphp08 Nov 2013
20RISK
open ↗
Exploit-DB
Sagemcom F@st 3184 2.1.11 - Multiple Vulnerabilities
CVE-2013-5039—webappshardware08 Nov 2013
Cross-site request forgery (CSRF) vulnerability in goform/wlanBasicSecurity on the HOT HOTBOX router with software 2.1.1
23RISK
open ↗
Exploit-DB
Sagemcom F@st 3184 2.1.11 - Multiple Vulnerabilities
CVE-2013-5038—webappshardware08 Nov 2013
The HOT HOTBOX router with software 2.1.11 allows remote attackers to bypass authentication by configuring a source IP a
23RISK
open ↗
Exploit-DB
Sagemcom F@st 3184 2.1.11 - Multiple Vulnerabilities
CVE-2013-5219—webappshardware08 Nov 2013
Directory traversal vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to read arbitrar
23RISK
open ↗
Exploit-DB
Project'Or RIA 3.4.0 - 'objectDetail.php?objectId' SQL Injection
CVE-2013-6164—webappsphp08 Nov 2013
SQL injection vulnerability in view/objectDetail.php in Project'Or RIA 3.4.0 allows remote attackers to execute arbitrar
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Vivotek IP Cameras - RTSP Authentication Bypass
CVE-2013-4985—webappshardware08 Nov 2013
Multiple Vivotek IP Cameras remote authentication bypass that could allow access to the video stream
23RISK
open ↗
Exploit-DB✓ VexDay Proof
VICIdial Manager - Send OS Command Injection (Metasploit)
CVE-2013-4467—remotelinux08 Nov 2013
Multiple SQL injection vulnerabilities in the agent interface (agc/) in VICIDIAL dialer (aka Asterisk GUI client) 2.8-40
50RISK
open ↗
Exploit-DB
Sagemcom F@st 3184 2.1.11 - Multiple Vulnerabilities
CVE-2013-5037—webappshardware08 Nov 2013
The HOT HOTBOX router with software 2.1.11 has a default WPS PIN of 12345670, which makes it easier for remote attackers
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Horde Groupware Web Mail Edition 5.1.2 - Cross-Site Request Forgery (2)
CVE-2013-6364—webappsphp08 Nov 2013
Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book
23RISK
open ↗
Exploit-DB
appRain 3.0.2 - Blind SQL Injection
CVE-2013-6058—webappsphp08 Nov 2013
SQL injection vulnerability in appRain CMF 3.0.2 and earlier allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
← previouspage 244 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.