Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,062cataloged exploits

31,617CVEs with public exploitation

0lab-tested

All Exploit-DB 22,467Referência 19,791GitHub PoC 13,086VulnCheck XDB 8,069Nuclei 4,187Metasploit 3,462✓ verified onlyrecent popular risk

4,187 exploits

Nucleicritical

Apache Struts2 S2-012 RCE

CVE-2013-1965—

Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute

40RISK

open ↗

Nucleimedium

Apache Struts - Multiple Open Redirection Vulnerabilities

CVE-2013-2248—

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to

60RISK

open ↗

Nucleicritical

Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution

CVE-2013-2251CRITICALunder attack

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a

100RISK

open ↗

Nucleimedium

WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting

CVE-2013-2287—

Multiple cross-site scripting (XSS) vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow

38RISK

open ↗

Nucleimedium

Telaen => v1.3.1 - Open Redirect

CVE-2013-2621—

Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victim

43RISK

open ↗

Nucleimedium

WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scripting

CVE-2013-3526—

Cross-site scripting (XSS) vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earli

43RISK

open ↗

Nucleimedium

Javafaces LFI

CVE-2013-3827—

Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2;

50RISK

open ↗

Nucleimedium

WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting

CVE-2013-4117—

Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for

43RISK

open ↗

Nucleimedium

WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting

CVE-2013-4625—

Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPr

43RISK

open ↗

Nucleilow

AVTECH DVR - Login Verification Code Bypass

CVE-2013-4982—

AVTECH AVN801 DVR has a security bypass via the administration login captcha

43RISK

open ↗

Nucleimedium

Cisco Unified Communications Manager 7/8/9 - Directory Traversal

CVE-2013-5528—

Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager all

43RISK

open ↗

Nucleimedium

Xibo 1.2.2/1.4.1 - Directory Traversal

CVE-2013-5979—

Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attacke

43RISK

open ↗

Nucleimedium

WordPress Spreadsheet - Cross-Site Scripting

CVE-2013-6281—

Cross-site scripting (XSS) vulnerability in codebase/spreadsheet.php in the Spreadsheet (dhtmlxSpreadsheet) plugin 2.0 f

18RISK

open ↗

Nucleimedium

Zimbra Collaboration Server 7.2.2/8.0.2 Local File Inclusion

CVE-2013-7091—

Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zim

60RISK

open ↗

Nucleimedium

WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal

CVE-2013-7240—

Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote

43RISK

open ↗

Nucleicritical

XStream <1.4.6/1.4.10 - Remote Code Execution

CVE-2013-7285—

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a rem

60RISK

open ↗

Nucleimedium

Sitecore CMS - Cross-Site Scripting

CVE-2014-100004—

Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev. 140120) allows remote attackers to in

18RISK

open ↗

Nucleihigh

DomPHP 0.83 - Directory Traversal

CVE-2014-10037—

Directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impact via a ..

43RISK

open ↗

Nucleicritical

Eyou E-Mail <3.6 - Remote Code Execution

CVE-2014-1203—

The get_login_ip_config_file function in Eyou Mail System before 3.6 allows remote attackers to execute arbitrary comman

23RISK

open ↗

Nucleicritical

ZTE Cable Modem Web Shell

CVE-2014-2321—

web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd

50RISK

open ↗

Nucleicritical

Lighttpd 1.4.34 SQL Injection and Path Traversal

CVE-2014-2323—

SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary

30RISK

open ↗

Nucleimedium

Dompdf < v0.6.0 - Local File Inclusion

CVE-2014-2383—

dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroo

50RISK

open ↗

Nucleimedium

Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting

CVE-2014-2908—

Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x

43RISK

open ↗

Nucleihigh

Belkin N150 Router 1.00.08/1.00.09 - Path Traversal

CVE-2014-2962—

Absolute path traversal vulnerability in the webproc cgi module on the Belkin N150 F9K1009 v1 router with firmware befor

50RISK

open ↗

Nucleimedium

ElasticSearch v1.1.1/1.2 RCE

CVE-2014-3120HIGHunder attack

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut

100RISK

open ↗

Nucleicritical

Seagate BlackArmor NAS - Command Injection

CVE-2014-3206—

Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmg

30RISK

open ↗

Nucleihigh

Drupal SQL Injection

CVE-2014-3704—

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct

60RISK

open ↗

Nucleihigh

Node.js st module Directory Traversal

CVE-2014-3744—

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi

30RISK

open ↗

Nucleimedium

Oracle Weblogic - Server-Side Request Forgery

CVE-2014-4210—

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allo

30RISK

open ↗

Nucleimedium

ActiveHelper LiveHelp Server 3.1.0 - Cross-Site Scripting

CVE-2014-4513—

Multiple cross-site scripting (XSS) vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin

18RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.