Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,039cataloged exploits
39,796CVEs with public exploitation
24,695lab-tested
AllReferência 25,790Exploit-DB 24,487GitHub PoC 16,910VulnCheck XDB 9,820Nuclei 4,504Metasploit 3,528✓ verified onlyrecentpopularrisk
3,523 exploits
Metasploit500
Adobe Flash Player NetConnection Type Confusion
CVE-2015-0336—12 Mar 2015
Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451
60RISK
open ↗
Metasploit600
iPass Mobile Client Service Privilege Escalation
CVE-2015-0925—12 Mar 2015
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via
50RISK
open ↗
Metasploit600
Microsoft Windows Shell LNK Code Execution
CVE-2015-0096—10 Mar 2015
Untrusted search path vulnerability in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and
60RISK
open ↗
Metasploit600
Microsoft Windows Shell LNK Code Execution
CVE-2015-0096—10 Mar 2015
Untrusted search path vulnerability in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and
60RISK
open ↗
Metasploit600
WordPress WPshop eCommerce Arbitrary File Upload Vulnerability
CVE-2015-10135CRITICAL09 Mar 2015
WPshop 2 – E-Commerce < 1.3.9.6 - Arbitrary File Upload
43RISK
open ↗
Metasploit300
WordPress CP Multi-View Calendar Unauthenticated SQL Injection Scanner
CVE-2014-8586—03 Mar 2015
SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to exe
50RISK
open ↗
Metasploit600
PHPMoAdmin 1.1.2 Remote Code Execution
CVE-2015-2208—03 Mar 2015
The saveObject function in moadmin.php in phpMoAdmin 1.1.2 allows remote attackers to execute arbitrary commands via she
50RISK
open ↗
Metasploit300
Seagate Business NAS Unauthenticated Remote Command Execution
CVE-2014-8686—01 Mar 2015
CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-
50RISK
open ↗
Metasploit300
Seagate Business NAS Unauthenticated Remote Command Execution
CVE-2014-8687—01 Mar 2015
Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root
50RISK
open ↗
Metasploit300
Seagate Business NAS Unauthenticated Remote Command Execution
CVE-2014-8684—01 Mar 2015
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof
60RISK
open ↗
Metasploit300
D-Link/TRENDnet NCC Service Command Injection
CVE-2015-1187CRITICALunder attack26 Feb 2015
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr
100RISK
open ↗
Metasploit300
WordPress WP EasyCart Plugin Privilege Escalation
CVE-2015-2673—25 Feb 2015
The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyC
23RISK
open ↗
Metasploit300
Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation
CVE-2014-9566—24 Feb 2015
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
50RISK
open ↗
Metasploit300
WordPress Contus Video Gallery Unauthenticated SQL Injection Scanner
CVE-2015-2065—24 Feb 2015
SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin b
50RISK
open ↗
Metasploit500
D-Link DCS-931L File Upload
CVE-2015-2049—23 Feb 2015
Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated use
50RISK
open ↗
Metasploit300
D-Link Devices HNAP SOAPAction-Header Command Execution
CVE-2015-2051HIGHunder attack13 Feb 2015
The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute ar
100RISK
open ↗
Metasploit600
ElasticSearch Search Groovy Sandbox Bypass
CVE-2015-1427CRITICALunder attack11 Feb 2015
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
100RISK
open ↗
Metasploit400
SixApart MovableType Storable Perl Code Execution
CVE-2015-1592—11 Feb 2015
Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use
60RISK
open ↗
Metasploit600
Maarch LetterBox Unrestricted File Upload
CVE-2015-1587—11 Feb 2015
Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earl
50RISK
open ↗
Metasploit600
WordPress Holding Pattern Theme Arbitrary File Upload
CVE-2015-1172—11 Feb 2015
Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 a
50RISK
open ↗
Metasploit300
WordPress WPLMS Theme Privilege Escalation
CVE-2015-10139HIGH09 Feb 2015
WPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege Escalation
36RISK
open ↗
Metasploit600
Ektron 8.5, 8.7, 9.0 XSLT Transform Remote Code Execution
CVE-2015-0923—05 Feb 2015
The ContentBlockEx method in Workarea/ServerControlWS.asmx in Ektron Content Management System (CMS) 8.5 and 8.7 before
23RISK
open ↗
Metasploit500
Adobe Flash Player ByteArray With Workers Use After Free
CVE-2015-0313HIGHunder attack02 Feb 2015
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
100RISK
open ↗
Metasploit300
MS15-018 Microsoft Internet Explorer 10 and 11 Cross-Domain JavaScript Injection
CVE-2015-0072—01 Feb 2015
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass t
60RISK
open ↗
Metasploit300
X360 VideoPlayer ActiveX Control Buffer Overflow
CVE-2025-34128HIGH30 Jan 2015
X360 VideoPlayer ActiveX Control Buffer Overflow via ConvertFile()
36RISK
open ↗
Metasploit600
Oracle Weblogic Server Deserialization RCE - Raw Object
CVE-2015-4852CRITICALunder attack28 Jan 2015
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
100RISK
open ↗
Metasploit300
ManageEngine Multiple Products Arbitrary File Download
CVE-2014-7863—28 Jan 2015
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, O
60RISK
open ↗
Metasploit300
ManageEngine Multiple Products Arbitrary Directory Listing
CVE-2014-7863—28 Jan 2015
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, O
60RISK
open ↗
Metasploit500
Exim GHOST (glibc gethostbyname) Buffer Overflow
CVE-2015-0235—27 Jan 2015
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,
60RISK
open ↗
Metasploit600
IPass Control Pipe Remote Command Execution
CVE-2015-0925—21 Jan 2015
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via
50RISK
open ↗
← previouspage 54 / 118next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.