Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.886exploits catalogados

32.153CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 19.978GitHub PoC 13.282VulnCheck XDB 8.176Nuclei 4.202Metasploit 3.462✓ só verificadosrecentes populares risco

4.202 exploits

Nucleihigh

XWiki < 4.10.15 - Sensitive Information Disclosure

CVE-2023-50719HIGH

XWiki Platform Solr search discloses password hashes of all users

58RISCO

abrir ↗

Nucleimedium

XWiki < 4.10.15 - Email Disclosure

CVE-2023-50720MEDIUM

XWiki Platform Solr search discloses email addresses of users

40RISCO

abrir ↗

Nucleicritical

D-Link D-View 8 v2.0.1.28 - Authentication Bypass

CVE-2023-5074CRITICAL

Authentication Bypass in D-Link D-View 8

55RISCO

abrir ↗

Nucleicritical

JS Help Desk <= 2.8.1 - SQL Injection

CVE-2023-50839CRITICAL

WordPress JS Help Desk – Best Help Desk & Support Plugin <= 2.8.1 is vulnerable to SQL Injection

63RISCO

abrir ↗

Nucleimedium

Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)

CVE-2023-5089MEDIUM

Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)

28RISCO

abrir ↗

Nucleicritical

MajorDoMo thumb.php - OS Command Injection

CVE-2023-50917—

MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE:

50RISCO

abrir ↗

Nucleihigh

Apache OFBiz < 18.12.11 - Server Side Request Forgery

CVE-2023-50968—

Apache OFBiz: Arbitrary file properties reading and SSRF attack

30RISCO

abrir ↗

Nucleicritical

Jordy Meow AI Engine - Unrestricted File Upload

CVE-2023-51409CRITICAL

WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability

75RISCO

abrir ↗

Nucleihigh

Gradio Hugging Face - Local File Inclusion

CVE-2023-51449MEDIUM

Make the `/file` secure against file traversal attacks

28RISCO

abrir ↗

Nucleimedium

Seriously Simple Podcasting < 3.0.0 - Information Disclosure

CVE-2023-6444MEDIUM

Seriously Simple Podcasting < 3.0.0 - Unauthenticated Administrator Email Disclosure

28RISCO

abrir ↗

Nucleihigh

Prime Mover < 1.9.3 - Sensitive Data Exposure

CVE-2023-6505HIGH

Prime Mover < 1.9.3 - Directory Listing to Sensitive Data Exposure

48RISCO

abrir ↗

Nucleicritical

Citrix Netscaler ADC & Gateway - Out-Of-Bounds Memory Read

CVE-2023-6549HIGHsob ataque

Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Un

78RISCO

abrir ↗

Nucleicritical

Worpress Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

CVE-2023-6553CRITICAL

Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

85RISCO

abrir ↗

Nucleihigh

LearnPress <= 4.2.5.7 - SQL Injection

CVE-2023-6567CRITICAL

LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by

75RISCO

abrir ↗

Nucleimedium

Mlflow - Cross-Site Scripting

CVE-2023-6568MEDIUM

Reflected XSS via Content-Type Header in mlflow/mlflow

28RISCO

abrir ↗

Nucleimedium

WordPress FastDup <= 2.1.9 Sensitive Information Exposure - Directory Listing

CVE-2023-6592MEDIUM

FastDup – Fastest WordPress Migration & Duplicator < 2.2 - Directory Listing to Account Takeover and Sensitive Data Exposure

28RISCO

abrir ↗

Nucleicritical

Essential Blocks < 4.4.3 - Local File Inclusion

CVE-2023-6623CRITICAL

Essential Blocks < 4.4.3 - Unauthenticated Local File Inclusion

75RISCO

abrir ↗

Nucleicritical

LearnPress < 4.2.5.8 - Remote Code Execution

CVE-2023-6634HIGH

LearnPress <= 4.2.5.7 - Command Injection

56RISCO

abrir ↗

Nucleihigh

Hongjing e-HR 2020 - SQL Injection

CVE-2023-6655HIGH

Hongjing e-HR Login Interface loadhistroyorgtree sql injection

36RISCO

abrir ↗

Nucleimedium

WP Go Maps (formerly WP Google Maps) < 9.0.29 - Cross-Site Scripting

CVE-2023-6697MEDIUM

WP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site Scripting

28RISCO

abrir ↗

Nucleicritical

WordPress WP Clone <= 2.4.2 - Database Backup Exposure

CVE-2023-6750HIGH

Clone < 2.4.3 - Unauthenticated Backup Download

36RISCO

abrir ↗

Nucleimedium

Payment Gateway for Telcell < 2.0.4 - Open Redirect

CVE-2023-6786MEDIUM

Payment Gateway for Telcell <= 2.0.1 - Unauthenticated Open Redirect

28RISCO

abrir ↗

Nucleicritical

WordPress File Manager <= 7.2.1 - Directory Traversal

CVE-2023-6825CRITICAL

File Manager And File Manager Pro (Multiple Versions) - Directory Traversal

43RISCO

abrir ↗

Nucleihigh

mlflow - Path Traversal

CVE-2023-6831HIGH

Path Traversal: '\..\filename' in mlflow/mlflow

36RISCO

abrir ↗

Nucleicritical

WordPress POST SMTP Mailer <= 2.8.7 - Authorization Bypass

CVE-2023-6875CRITICAL

POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API

85RISCO

abrir ↗

Nucleicritical

Hikvision IP ping.php - Command Execution

CVE-2023-6895MEDIUM

Hikvision Intercom Broadcasting System ping.php os command injection

70RISCO

abrir ↗

Nucleihigh

Mlflow <2.9.2 - Path Traversal

CVE-2023-6909HIGH

Path Traversal: '\..\filename' in mlflow/mlflow

58RISCO

abrir ↗

Nucleicritical

Better Search Replace < 1.4.5 - PHP Object Injection

CVE-2023-6933HIGH

Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection

68RISCO

abrir ↗

Nucleimedium

WP Recipe Maker <= 9.1.0 - Reflected XSS via Referer Header

CVE-2023-6970MEDIUM

WP Recipe Maker <= 9.1.0 - Reflected Cross-Site Scripting via Referer

28RISCO

abrir ↗

Nucleihigh

Mlflow <2.8.0 - Local File Inclusion

CVE-2023-6977CRITICAL

Path Traversal: '\..\filename'

43RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.