Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,902cataloged exploits
34,597CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,624GitHub PoC 13,727VulnCheck XDB 8,410Nuclei 4,231Metasploit 3,467✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB
Asus RT56U 3.0.0.4.360 - Remote Command Injection
CVE-2013-5948—webappshardware07 Jun 2013
The Network Analysis tab (Main_Analysis_Content.asp) in the ASUS RT-AC68U and other RT series routers with firmware befo
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer - textNode Use-After-Free (MS13-037) (Metasploit)
CVE-2013-1311—remotewindows07 Jun 2013
Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a cr
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Novell ZENworks Mobile Device Managment 2.6.1/2.7.0 - Local File Inclusion (Metasploit)
CVE-2013-1081—webappswindows07 Jun 2013
Directory traversal vulnerability in MDM.php in Novell ZENworks Mobile Management (ZMM) 2.6.1 and 2.7.0 allows remote at
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Linux Kernel 3.3.5 - 'b43' Wireless Driver Privilege Escalation
CVE-2013-2852—locallinux07 Jun 2013
Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Quick TFTP Server Pro 2.2 - Denial of Service
CVE-2008-1610—doswindows07 Jun 2013
Stack-based buffer overflow in TallSoft Quick TFTP Server Pro 2.1 allows remote attackers to cause a denial of service o
50RISK
open ↗
Exploit-DB
Imperva SecureSphere Operations Manager 9.0.0.5 - Multiple Vulnerabilities
CVE-2013-4094—webappsjsp05 Jun 2013
The Key Management feature in the SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
MiniUPnPd 1.0 - Remote Stack Buffer Overflow Remote Code Execution (Metasploit)
CVE-2013-0230—remotelinux05 Jun 2013
Stack-based buffer overflow in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP
50RISK
open ↗
Exploit-DB
Imperva SecureSphere Operations Manager 9.0.0.5 - Multiple Vulnerabilities
CVE-2013-4095—webappsjsp05 Jun 2013
plain/actionsets.html in the SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 all
23RISK
open ↗
Exploit-DB
Imperva SecureSphere Operations Manager 9.0.0.5 - Multiple Vulnerabilities
CVE-2013-4092—webappsjsp05 Jun 2013
The SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 allows context-dependent att
23RISK
open ↗
Exploit-DB✓ VexDay Proof
QNAP VioStor NVR / QNAP NAS - Remote Code Execution
CVE-2013-0143—webappscgi05 Jun 2013
cgi-bin/pingping.cgi on QNAP VioStor NVR devices with firmware 4.0.3, and in the Surveillance Station Pro component in Q
23RISK
open ↗
Exploit-DB
Imperva SecureSphere Operations Manager 9.0.0.5 - Multiple Vulnerabilities
CVE-2013-4091—webappsjsp05 Jun 2013
The SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 does not have an off autocom
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Xpient - Cash Drawer Operation
CVE-2013-2571—remotehardware05 Jun 2013
Iris 3.8 before build 1548, as used in Xpient point of sale (POS) systems, allows remote attackers to execute arbitrary
28RISK
open ↗
Exploit-DB
Imperva SecureSphere Operations Manager 9.0.0.5 - Multiple Vulnerabilities
CVE-2013-4093—webappsjsp05 Jun 2013
The SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 allows remote attackers to o
23RISK
open ↗
Exploit-DB
DS3 Authentication Server - Multiple Vulnerabilities
CVE-2013-4097—webappshardware05 Jun 2013
ServerAdmin/TestDRConnection.jsp in DS3 Authentication Server allows remote attackers to obtain sensitive information vi
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Apache Struts - OGNL Expression Injection
CVE-2013-2134—remotemultiple05 Jun 2013
Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted acti
45RISK
open ↗
Exploit-DB✓ VexDay Proof
Apache Struts - includeParams Remote Code Execution (Metasploit)
CVE-2013-2115—remotemultiple05 Jun 2013
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not
60RISK
open ↗
Exploit-DB✓ VexDay Proof
Apache Struts - includeParams Remote Code Execution (Metasploit)
CVE-2013-1966—remotemultiple05 Jun 2013
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not
60RISK
open ↗
Exploit-DB✓ VexDay Proof
Oracle WebCenter Content - 'CheckOutAndOpen.dll' ActiveX Remote Code Execution (Metasploit)
CVE-2013-1559—remotewindows05 Jun 2013
Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Plesk < 9.5.4 - Remote Command Execution
CVE-2013-4878—remotephp05 Jun 2013
The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has a
35RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple Mac OSX Server - DirectoryService Buffer Overflow
CVE-2013-0984—dososx05 Jun 2013
Directory Service in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial o
28RISK
open ↗
Exploit-DB
DS3 Authentication Server - Multiple Vulnerabilities
CVE-2013-4096—webappshardware05 Jun 2013
ServerAdmin/TestTelnetConnection.jsp in DS3 Authentication Server allows remote authenticated users to execute arbitrary
23RISK
open ↗
Exploit-DB
DS3 Authentication Server - Multiple Vulnerabilities
CVE-2013-4098—webappshardware05 Jun 2013
ServerAdmin/ErrorViewer.jsp in DS3 Authentication Server allow remote attackers to inject arbitrary error-page text via
23RISK
open ↗
Exploit-DB✓ VexDay Proof
MongoDB - 'conn' Mongo Object Remote Code Execution
CVE-2013-3969—remotemultiple04 Jun 2013
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Telaen 2.7.x - Cross-Site Scripting
CVE-2013-2623—webappsphp04 Jun 2013
Cross-site Scripting (XSS) in Telaen before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Telaen 2.7.x - Open Redirection
CVE-2013-2621—webappsphp04 Jun 2013
Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victim
43RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows NT/2000/2003/2008/XP/Vista/7/8 - 'EPATHOBJ' Local Ring
CVE-2013-3661—localwindows03 Jun 2013
The EPATHOBJ::bFlatten function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vist
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Telaen - Information Disclosure
CVE-2013-2624—webappsphp03 Jun 2013
Telean before 1.3.1 contains a full path disclosure vulnerability which could allow remote attackers to obtain sensitive
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows NT/2000/2003/2008/XP/Vista/7/8 - 'EPATHOBJ' Local Ring
CVE-2013-3660HIGHunder attacklocalwindows03 Jun 2013
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windo
98RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows NT/2000/2003/2008/XP/Vista/7/8 - 'EPATHOBJ' Local Ring
CVE-2013-3130—localwindows03 Jun 2013
20RISK
open ↗
Exploit-DB
ModSecurity - Remote Null Pointer Dereference
CVE-2013-2765—dosmultiple31 May 2013
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NUL
28RISK
open ↗
← previouspage 256 / 815next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.