Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,107cataloged exploits

36,322CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,464Referência 22,936GitHub PoC 15,010VulnCheck XDB 8,846Nuclei 4,361Metasploit 3,490✓ verified onlyrecent popular risk

19,066 exploits

Exploit-DB✓ VexDay Proof

Sendio ESP - Information Disclosure

CVE-2014-8391—webappsjsp26 May 2015

The Web interface in Sendio before 7.2.4 does not properly handle sessions, which allows remote authenticated users to o

23RISK

Exploit-DB✓ VexDay Proof

WordPress Plugin NewStatPress 0.9.8 - Multiple Vulnerabilities

CVE-2015-4062—webappsphp26 May 2015

SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remo

38RISK

Exploit-DB✓ VexDay Proof

Fuse 2.9.3-15 - Local Privilege Escalation

CVE-2015-3202—locallinux23 May 2015

fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as ro

23RISK

Exploit-DB✓ VexDay Proof

Phoenix Contact ILC 150 ETH PLC - Remote Control Script

CVE-2014-9195—remotehardware20 May 2015

Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function

85RISK

Exploit-DB✓ VexDay Proof

WordPress Plugin FeedWordPress 2015.0426 - SQL Injection

CVE-2015-4018—webappsphp20 May 2015

SQL injection vulnerability in feedwordpresssyndicationpage.class.php in the FeedWordPress plugin before 2015.0514 for W

23RISK

Exploit-DB✓ VexDay Proof

Microsoft Windows 8.0/8.1 (x64) - 'TrackPopupMenu' Local Privilege Escalation (MS14-058)

CVE-2014-4113HIGHunder attacklocalwindows_x86-6419 May 2015

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 a

100RISK

Exploit-DB✓ VexDay Proof

Microsoft Windows - Local Privilege Escalation (MS15-051)

CVE-2015-1678—localwindows18 May 2015

The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Win

23RISK

Exploit-DB✓ VexDay Proof

Microsoft Windows - Local Privilege Escalation (MS15-051)

CVE-2015-1676—localwindows18 May 2015

The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Win

23RISK

Exploit-DB✓ VexDay Proof

Microsoft Windows - Local Privilege Escalation (MS15-051)

CVE-2015-1701HIGHunder attackransomwarelocalwindows18 May 2015

Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local

98RISK

Exploit-DB✓ VexDay Proof

Microsoft Windows - Local Privilege Escalation (MS15-051)

CVE-2015-1679—localwindows18 May 2015

The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Win

23RISK

Exploit-DB✓ VexDay Proof

Microsoft Windows - Local Privilege Escalation (MS15-051)

CVE-2015-1677—localwindows18 May 2015

The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Win

23RISK

Exploit-DB✓ VexDay Proof

Microsoft Windows - Local Privilege Escalation (MS15-051)

CVE-2015-1680—localwindows18 May 2015

The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Win

23RISK

Exploit-DB✓ VexDay Proof

Adobe Flash Player - NetConnection Type Confusion (Metasploit)

CVE-2015-0336—remotewindows08 May 2015

Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451

60RISK

Exploit-DB✓ VexDay Proof

Novell ZENworks Configuration Management - Arbitrary File Upload (Metasploit)

CVE-2015-0779—remotejava08 May 2015

Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management (ZCM) 10 and 11 before 11

60RISK

Exploit-DB✓ VexDay Proof

Adobe Flash Player - domainMemory ByteArray Use-After-Free (Metasploit)

CVE-2015-0359—remotewindows08 May 2015

Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and

60RISK

Exploit-DB✓ VexDay Proof

WordPress Plugin RevSlider 3.0.95 - Arbitrary File Upload / Execution (Metasploit)

CVE-2014-9735—remotephp08 May 2015

The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier

60RISK

Exploit-DB✓ VexDay Proof

Adobe Flash Player - UncompressViaZlibVariant Uninitialized Memory (Metasploit)

CVE-2014-8440—remotewindows01 May 2015

Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on

60RISK

Exploit-DB✓ VexDay Proof

WordPress Core 4.2 - Persistent Cross-Site Scripting

CVE-2015-3440—webappsphp27 Apr 2015

Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to i

28RISK

Exploit-DB✓ VexDay Proof

Free MP3 CD Ripper 2.6 2.8 (Windows 7) - '.wav' File Buffer Overflow (SEH) (DEP Bypass)

CVE-2011-5165—localwindows24 Apr 2015

Stack-based buffer overflow in Free MP3 CD Ripper 1.1, 2.6 and earlier, when converting a file, allows user-assisted rem

50RISK

Exploit-DB✓ VexDay Proof

Free MP3 CD Ripper 2.6 2.8 - '.wav' File Buffer Overflow (SEH)

CVE-2011-5165—localwindows23 Apr 2015

Stack-based buffer overflow in Free MP3 CD Ripper 1.1, 2.6 and earlier, when converting a file, allows user-assisted rem

50RISK

Exploit-DB✓ VexDay Proof

GoAutoDial CE 3.3-1406088000 - Authentication Bypass / Arbitrary File Upload / Command Injection

CVE-2015-2845—webappsphp21 Apr 2015

The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1421902800 allows remote attackers to execute arb

60RISK

Exploit-DB✓ VexDay Proof

WordPress Plugin Creative Contact Form - Arbitrary File Upload (Metasploit)

CVE-2014-8739—remotephp21 Apr 2015

Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery

60RISK

Exploit-DB✓ VexDay Proof

GoAutoDial CE 3.3-1406088000 - Authentication Bypass / Arbitrary File Upload / Command Injection

CVE-2015-2842—webappsphp21 Apr 2015

Unrestricted file upload vulnerability in go_audiostore.php in the audiostore (Voice Files) upload functionality in GoAu

28RISK

Exploit-DB✓ VexDay Proof

GoAutoDial CE 3.3-1406088000 - Authentication Bypass / Arbitrary File Upload / Command Injection

CVE-2015-2844—webappsphp21 Apr 2015

The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1420434000 allows remote attackers to execute arb

28RISK

Exploit-DB✓ VexDay Proof

GoAutoDial CE 3.3-1406088000 - Authentication Bypass / Arbitrary File Upload / Command Injection

CVE-2015-2843—webappsphp21 Apr 2015

Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute

50RISK

Exploit-DB✓ VexDay Proof

WordPress Plugin Reflex Gallery - Arbitrary File Upload (Metasploit)

CVE-2015-4133—remotephp21 Apr 2015

Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 f

50RISK

Exploit-DB✓ VexDay Proof

BlueDragon CFChart Servlet 7.1.1.17759 - Arbitrary File Retrieval/Deletion

CVE-2014-5370—webappscfm21 Apr 2015

Directory traversal vulnerability in the CFChart servlet (com.naryx.tagfusion.cfm.cfchartServlet) in New Atlanta BlueDra

23RISK

Exploit-DB✓ VexDay Proof

Adobe Flash Player - copyPixelsToByteArray Integer Overflow (Metasploit)

CVE-2014-0556—remotewindows21 Apr 2015

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS

60RISK

Exploit-DB✓ VexDay Proof

Apport/Abrt (Ubuntu / Fedora) - Local Privilege Escalation

CVE-2015-1862—locallinux14 Apr 2015

The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot

23RISK

Exploit-DB✓ VexDay Proof

Abrt (Fedora 21) - Race Condition

CVE-2015-1862—locallinux14 Apr 2015

The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot

23RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.