Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.886exploits catalogados
32.153CVEs com exploração pública
1.932testados em laboratório
TodosExploit-DB 22.786Referência 19.978GitHub PoC 13.282VulnCheck XDB 8.176Nuclei 4.202Metasploit 3.462✓ só verificadosrecentespopularesrisco
4.202 exploits
Nucleihigh
Oliver 5 Library Server <8.00.008.053 - Local File Inclusion
CVE-2021-45027—
An arbitrary file download vulnerability in Oliver v5 Library Server Versions < 5.00.008.053 via the FileServlet functio
18RISCO
abrir ↗
Nucleihigh
HD-Network Realtime Monitoring System 2.0 - Local File Inclusion
CVE-2021-45043—
HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_L
50RISCO
abrir ↗
Nucleicritical
Apache Log4j2 - Remote Code Injection
CVE-2021-45046CRITICALsob ataqueransomware
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
100RISCO
abrir ↗
Nucleicritical
Thinfinity Iframe Injection
CVE-2021-45092—
Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection vi
50RISCO
abrir ↗
Nucleicritical
Apache APISIX Dashboard <2.10.1 - API Unauthorized Access
CVE-2021-45232—
security vulnerability on unauthorized access.
40RISCO
abrir ↗
Nucleimedium
Gitea < 1.4.3 - Open Redirect
CVE-2021-45328—
Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs.
18RISCO
abrir ↗
Nucleimedium
AppCMS - Cross-Site Scripting
CVE-2021-45380—
AppCMS 2.0.101 has a XSS injection vulnerability in \templates\m\inc_head.php
18RISCO
abrir ↗
Nucleicritical
D-Link - Remote Command Execution
CVE-2021-45382CRITICALsob ataque
A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L
95RISCO
abrir ↗
Nucleicritical
Emerson Dixell XWEB-500 - Arbitrary File Write
CVE-2021-45420—
Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /
23RISCO
abrir ↗
Nucleimedium
Reprise License Manager 14.2 - Cross-Site Scripting
CVE-2021-45422—
Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability in the /goform/activate_proce
18RISCO
abrir ↗
Nucleicritical
Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Upload
CVE-2021-45428—
TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can uploa
50RISCO
abrir ↗
Nucleicritical
Control Web Panel (CWP) - File Inclusion
CVE-2021-45467CRITICAL
In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to c
65RISCO
abrir ↗
Nucleihigh
Slims9 Bulian 9.4.2 - SQL Injection
CVE-2021-45793—
Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained.
18RISCO
abrir ↗
Nucleimedium
osTicket 1.15.x - SQL Injection
CVE-2021-45811—
A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticate
18RISCO
abrir ↗
Nucleicritical
Pascom CPS Server-Side Request Forgery
CVE-2021-45967—
An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend To
23RISCO
abrir ↗
Nucleihigh
Pascom CPS - Local File Inclusion
CVE-2021-45968—
An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Pho
23RISCO
abrir ↗
Nucleimedium
Sourcecodester Car Rental Management System 1.0 - Stored Cross-Site Scripting
CVE-2021-46005—
Sourcecodester Car Rental Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via vehicalorcview parameter
18RISCO
abrir ↗
Nucleimedium
Vehicle Service Management System - Stored Cross-Site Scripting
CVE-2021-46068—
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the My Account Sec
18RISCO
abrir ↗
Nucleimedium
Vehicle Service Management System 1.0 - Stored Cross Site Scripting
CVE-2021-46069—
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Mechanic List
18RISCO
abrir ↗
Nucleimedium
ehicle Service Management System 1.0 - Cross-Site Scripting
CVE-2021-46071—
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Category List
18RISCO
abrir ↗
Nucleimedium
Vehicle Service Management System 1.0 - Stored Cross Site Scripting
CVE-2021-46072—
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service List S
18RISCO
abrir ↗
Nucleimedium
Vehicle Service Management System 1.0 - Cross Site Scripting
CVE-2021-46073—
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the
18RISCO
abrir ↗
Nucleihigh
webp_server_go 0.4.0 - Path Traversal
CVE-2021-46104—
An issue was discovered in webp_server_go 0.4.0. There is a directory traversal vulnerability that can read arbitrary fi
18RISCO
abrir ↗
Nucleihigh
Ligeo Archives Ligeo Basics - Server Side Request Forgery
CVE-2021-46107—
Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to Server Side Request Forgery (SSRF) which allows an attacke
18RISCO
abrir ↗
Nucleihigh
AntD Admin - Sensitive Information Disclosure
CVE-2021-46371—
antd-admin 5.5.0 is affected by an incorrect access control vulnerability. Unauthorized access to some interfaces in the
18RISCO
abrir ↗
Nucleimedium
D-Link DIR850 ET850-1.08TRb03 - Open Redirect
CVE-2021-46379—
DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrust
43RISCO
abrir ↗
Nucleicritical
WordPress KiviCare <2.3.9 - SQL Injection
CVE-2022-0786—
KiviCare < 2.3.9 - Unauthenticated SQLi
23RISCO
abrir ↗
Nucleicritical
Limit Login Attempts (Spam Protection) < 5.1 - SQL Injection
CVE-2022-0787—
Limit Login Attempts (Spam Protection) < 5.1 - Unauthenticated SQLi
18RISCO
abrir ↗
Nucleicritical
WordPress WP Fundraising Donation and Crowdfunding Platform <1.5.0 - SQL Injection
CVE-2022-0788—
WP Fundraising Donation and Crowdfunding Platform < 1.5.0 - Unauthenticated SQLi
18RISCO
abrir ↗
Nucleicritical
Ubigeo de Peru < 3.6.4 - SQL Injection
CVE-2022-0814—
Ubigeo de Peru < 3.6.4 - Unauthenticated SQLi
18RISCO
abrir ↗
← anteriorpágina 104 / 141próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.