Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.886exploits catalogados

32.153CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 19.978GitHub PoC 13.282VulnCheck XDB 8.176Nuclei 4.202Metasploit 3.462✓ só verificadosrecentes populares risco

4.202 exploits

Nucleihigh

DedeCMS 5.7 - Path Disclosure

CVE-2018-6910—

DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/in

23RISCO

abrir ↗

Nucleicritical

VMware NSX SD-WAN Edge - Command Injection

CVE-2018-6961HIGHsob ataque

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web U

100RISCO

abrir ↗

Nucleimedium

osTicket < 1.10.2 - Cross-Site Scripting

CVE-2018-7192—

Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remot

18RISCO

abrir ↗

Nucleimedium

osTicket < 1.10.2 - Cross-Site Scripting

CVE-2018-7193—

Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attac

18RISCO

abrir ↗

Nucleimedium

osTicket < 1.10.2 - Cross-Site Scripting

CVE-2018-7196—

Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers

18RISCO

abrir ↗

Nucleicritical

Anchor CMS 0.12.3 - Error Log Exposure

CVE-2018-7251—

An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contain

60RISCO

abrir ↗

Nucleicritical

TITool PrintMonitor - Blind SQL Injection

CVE-2018-7282—

The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based b

23RISCO

abrir ↗

Nucleimedium

Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated settings import/export

CVE-2019-17228—

includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin

18RISCO

abrir ↗

Nucleimedium

WordPress OneTone theme <= 3.0.6 – Unauthenticated Options Changes

CVE-2019-17230—

includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.

18RISCO

abrir ↗

Nucleimedium

WordPress OneTone theme <= 3.0.6 – Unauthenticated Stored XSS

CVE-2019-17231—

includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.

18RISCO

abrir ↗

Nucleihigh

WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated Options Import and Export

CVE-2019-17232—

Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options im

18RISCO

abrir ↗

Nucleimedium

WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection

CVE-2019-17233—

Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.

18RISCO

abrir ↗

Nucleicritical

Yachtcontrol Webapplication 1.0 - Remote Command Injection

CVE-2019-17270—

Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user vi

30RISCO

abrir ↗

Nucleicritical

Zabbix <=4.4 - Authentication Bypass

CVE-2019-17382—

An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass

30RISCO

abrir ↗

Nucleihigh

MetInfo 7.0.0 beta - SQL Injection

CVE-2019-17418—

An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=language&c=language_general&a=doSearchPa

30RISCO

abrir ↗

Nucleicritical

Jfrog Artifactory <6.17.0 - Default Admin Password

CVE-2019-17444CRITICAL

JFrog Artifactory does not enforce default admin password change

55RISCO

abrir ↗

Nucleimedium

Kirona Dynamic Resource Scheduler - Information Disclosure

CVE-2019-17503—

An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REG

50RISCO

abrir ↗

Nucleicritical

D-Link DIR-868L/817LW - Information Disclosure

CVE-2019-17506—

There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 route

30RISCO

abrir ↗

Nucleihigh

Jiangnan Online Judge 0.8.0 - Local File Inclusion

CVE-2019-17538—

Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file reading via the web/polygon/problem/viewfile?id=

23RISCO

abrir ↗

Nucleihigh

Apache Solr <=8.3.1 - Remote Code Execution

CVE-2019-17558HIGHsob ataque

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A V

100RISCO

abrir ↗

Nucleicritical

Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization

CVE-2019-17564—

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST

30RISCO

abrir ↗

Nucleicritical

Popup-Maker < 1.8.12 - Broken Authentication

CVE-2019-17574—

An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially

18RISCO

abrir ↗

Nucleicritical

ThinVNC 1.0b1 - Authentication Bypass

CVE-2019-17662—

ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exi

60RISCO

abrir ↗

Nucleimedium

WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts

CVE-2019-17671—

In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is m

50RISCO

abrir ↗

Nucleicritical

Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager - Remote Code Execution

CVE-2019-1821HIGH

Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities

78RISCO

abrir ↗

Nucleihigh

Xiaomi Mi WiFi R3G Routers - Local file Inclusion

CVE-2019-18371—

An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerabilit

50RISCO

abrir ↗

Nucleimedium

Ignite Realtime Openfire <4.42 - Local File Inclusion

CVE-2019-18393—

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the

23RISCO

abrir ↗

Nucleicritical

Ignite Realtime Openfire <=4.4.2 - Server-Side Request Forgery

CVE-2019-18394—

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allo

30RISCO

abrir ↗

Nucleihigh

DOMOS 5.5 - Local File Inclusion

CVE-2019-18665—

The Log module in SECUDOS DOMOS before 5.6 allows local file inclusion.

23RISCO

abrir ↗

Nucleicritical

strapi CMS <3.0.0-beta.17.5 - Admin Password Reset

CVE-2019-18818—

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s

60RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.