I am new in the field and trying to pentest a php web app locally stored on my host pc using metasploit from a kali vm. I have run some scanners like wmap,OpenVAS and Nessus and found some vulnerabilities but i have trouble finding the matching exploits to use in msf. I have tried 'search cve-xxxx-xxxx' and even on google using 'cve-xxxx-xxxx metasploit' etc but had no results. Are there any suggestions on how to proceed? For example a critical one found is CVE-2014-3515 however i was unable to find an exploit.
CVE is only the vulnerability report, it doesn't necessarily mean that it is exploitable. Also, we are very fortunate that even if exploitable, not all vulnerabilities have publicly available exploits, and especially ones that are available within the Metasploit framework. Otherwise we would have lots of script-kiddies running around armed and dangerous!
On the question of CVE-2014-3515 - this is something that is listed as "exploitable using common tools" - meaning that you can create a PHP script that exploits the vulnerability, e.g. you don't need specially crafted shellcode or a compiled binary. Looking at the original detailed report of the vulnerability on php.net, it is relatively easy to create an exploit, given that one has a solid understanding of the PHP programming language, which most scripties don't have. \o/
When you're reviewing vulnerabilities in Nessus, if you view the "detailed vulnerability summary" it will tell you if there is a "public exploit available" for the vulnerability. If there is a public exploit available Nessus will tell you which module from within Metasploit to use. (I use Nessus enterprise on a daily basis).
As Milen said, just because the vulnerability is known and there is a CVE assigned to it, there will not always be an associated public available exploit with Metasploit or other pen testing tools.