Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
71.062exploits catalogados
31.617CVEs com exploração pública
0testados em laboratório
TodosExploit-DB 22.467Referência 19.791GitHub PoC 13.086VulnCheck XDB 8.069Nuclei 4.187Metasploit 3.462✓ só verificadosrecentespopularesrisco
22.467 exploits
Exploit-DB
phpIPAM 1.6 - Reflected Cross Site Scripting (XSS)
phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter
48RISCO
abrir ↗Exploit-DB
CyberPanel 2.3.6 - Remote Code Execution (RCE)
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers t
100RISCO
abrir ↗Exploit-DB
MiniCMS 1.1 - Cross Site Scripting (XSS)
MiniCMS version 1.1 contains a Cross Site Scripting (XSS) vulnerability in http://example.org/mc-admin/page.php?date={pa
23RISCO
abrir ↗Exploit-DB
qBittorrent 5.0.1 - MITM RCE
qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors.
41RISCO
abrir ↗Exploit-DB
WebFileSys 2.31.0 - Directory Path Traversal
An issue in the relPath parameter of WebFileSys version 2.31.0 allows attackers to perform directory traversal via a cra
33RISCO
abrir ↗Exploit-DB
RosarioSIS 7.6 - SQL Injection
An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunct
28RISCO
abrir ↗Exploit-DB
NEWS-BUZZ News Management System 1.0 - SQL Injection
code-projects/anirbandutta9 Content Management System/News-Buzz index.php sql injection
33RISCO
abrir ↗Exploit-DB
CodeAstro Online Railway Reservation System 1.0 - Cross Site Scripting (XSS)
CodeAstro Online Railway Reservation System Update Employee Page admin-update-employee.php cross site scripting
33RISCO
abrir ↗Exploit-DB
Typecho 1.3.0 - Race Condition
Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function. This vulnerabil
33RISCO
abrir ↗Exploit-DB
Cosy+ firmware 21.2s7 - Command Injection
Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to code injection due
41RISCO
abrir ↗Exploit-DB
Centron 19.04 - Remote Code Execution (RCE)
Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitra
35RISCO
abrir ↗Exploit-DB
flatCore 1.5.5 - Arbitrary File Upload
An issue was discovered in flatCore 1.4.7. acp/acp.php allows remote authenticated administrators to upload arbitrary .p
23RISCO
abrir ↗Exploit-DB
Cisco Smart Software Manager On-Prem 8-202206 - Account Takeover
A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauth
85RISCO
abrir ↗Exploit-DB
Typecho 1.3.0 - Stored Cross-Site Scripting (XSS)
A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or
41RISCO
abrir ↗Exploit-DB
PZ Frontend Manager WordPress Plugin 1.0.5 - Cross Site Request Forgery (CSRF)
pz-frontend-manager < 1.0.6 - CSRF change user profile picture
41RISCO
abrir ↗Exploit-DB
Apache HugeGraph Server 1.2.0 - Remote Code Execution (RCE)
Apache HugeGraph-Server: Command execution in gremlin
100RISCO
abrir ↗Exploit-DB
Zohocorp ManageEngine ADManager Plus 7210 - Elevation of Privilege
Privilege Escalation
41RISCO
abrir ↗Exploit-DB
Artica Proxy 4.50 - Remote Code Execution (RCE)
Artica Proxy Unauthenticated PHP Deserialization Vulnerability
85RISCO
abrir ↗Exploit-DB
Intelight X-1L Traffic controller Maxtime 1.9.6 - Remote Code Execution (RCE)
An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the
48RISCO
abrir ↗Exploit-DB
jQuery 3.3.1 - Prototype Pollution & XSS Exploit
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and re
23RISCO
abrir ↗Exploit-DB
jQuery 3.3.1 - Prototype Pollution & XSS Exploit
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus
45RISCO
abrir ↗Exploit-DB
Nagios Xi 5.6.6 - Authenticated Remote Code Execution (RCE)
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios
100RISCO
abrir ↗Exploit-DB
InfluxDB OSS 2.7.11 - Operator Token Privilege Escalation
InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows aut
48RISCO
abrir ↗Exploit-DB
GeoVision GV-ASManager 6.1.0.0 - Information Disclosure
Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which
46RISCO
abrir ↗Exploit-DB
Sony XAV-AX5500 1.13 - Firmware Update Validation Remote Code Execution (RCE)
Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability
33RISCO
abrir ↗Exploit-DB
XWiki Platform 15.10.10 - Remote Code Execution
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISCO
abrir ↗Exploit-DB
YesWiki 4.5.1 - Unauthenticated Path Traversal
Path Traversal allowing arbitrary read of files in Yeswiki
56RISCO
abrir ↗Exploit-DB
Apache Tomcat 11.0.3 - Remote Code Execution
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.