Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.886exploits catalogados

32.153CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 19.978GitHub PoC 13.282VulnCheck XDB 8.176Nuclei 4.202Metasploit 3.462✓ só verificadosrecentes populares risco

4.202 exploits

Nucleicritical

MinIO Operator Console Authentication Bypass

CVE-2021-41266HIGH

Authentication bypass issue in the Operator Console

48RISCO

abrir ↗

Nucleihigh

Metabase - Local File Inclusion

CVE-2021-41277CRITICALsob ataque

GeoJSON URL validation can expose server files and environment variables to unauthorized users

100RISCO

abrir ↗

Nucleihigh

pfSense - Arbitrary File Write

CVE-2021-41282—

diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data abo

40RISCO

abrir ↗

Nucleihigh

ECOA Building Automation System - Directory Traversal Content Disclosure

CVE-2021-41291HIGH

ECOA BAS controller - Path Traversal-1

58RISCO

abrir ↗

Nucleihigh

ECOA Building Automation System - Arbitrary File Retrieval

CVE-2021-41293HIGH

ECOA BAS controller - Path Traversal-3

41RISCO

abrir ↗

Nucleimedium

Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting

CVE-2021-41349MEDIUM

Microsoft Exchange Server Spoofing Vulnerability

70RISCO

abrir ↗

Nucleihigh

Payara Micro Community 5.2021.6 Directory Traversal

CVE-2021-41381—

Payara Micro Community 5.2021.6 and below allows Directory Traversal.

50RISCO

abrir ↗

Nucleicritical

QVIS NVR/DVR - Remote Code Execution

CVE-2021-41419—

QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization.

18RISCO

abrir ↗

Nucleimedium

FlatPress 1.2.1 - Stored Cross-Site Scripting

CVE-2021-41432—

A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaS

18RISCO

abrir ↗

Nucleihigh

ECShop 4.1.0 - SQL Injection

CVE-2021-41460—

ECShop 4.1.0 has SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information.

18RISCO

abrir ↗

Nucleimedium

JustWriting - Cross-Site Scripting

CVE-2021-41467—

Cross-site scripting (XSS) vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow rem

18RISCO

abrir ↗

Nucleihigh

SAS/Internet 9.4 1520 - Local File Inclusion

CVE-2021-41569—

SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included by default) in the app

18RISCO

abrir ↗

Nucleihigh

PuneethReddyHC action.php SQL Injection

CVE-2021-41648—

An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId

23RISCO

abrir ↗

Nucleicritical

PuneethReddyHC Online Shopping System homeaction.php SQL Injection

CVE-2021-41649—

An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php c

30RISCO

abrir ↗

Nucleicritical

TP-Link - OS Command Injection

CVE-2021-41653—

The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to r

60RISCO

abrir ↗

Nucleihigh

openSIS Student Information System 8.0 SQL Injection

CVE-2021-41691CRITICAL

A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TR

43RISCO

abrir ↗

Nucleicritical

CraftCMS SEOmatic - Server-Side Template Injection

CVE-2021-41749—

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Si

23RISCO

abrir ↗

Nucleicritical

Apache Log4j2 Remote Code Injection

CVE-2021-44228CRITICALsob ataqueransomware

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

abrir ↗

Nucleihigh

WAVLINK AC1200 - Information Disclosure

CVE-2021-44260—

A vulnerability is in the 'live_mfg.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can al

18RISCO

abrir ↗

Nucleicritical

3DPrint Lite < 1.9.1.5 - Arbitrary File Upload

CVE-2021-4436CRITICAL

3DPrint Lite < 1.9.1.5 - Unauthenticated Arbitrary File Upload

63RISCO

abrir ↗

Nucleicritical

Rosario Student Information System Unauthenticated SQL Injection

CVE-2021-44427CRITICAL

An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allow

55RISCO

abrir ↗

Nucleimedium

Apache Superset <=1.3.2 - Default Login

CVE-2021-44451—

API sensitive information leak

18RISCO

abrir ↗

Nucleihigh

Kaswara Modern VC Addons <= 3.0.1 - Missing Authorization

CVE-2021-4448HIGH

Kaswara Modern VC Addons <= 3.0.1 - Missing Authorization

36RISCO

abrir ↗

Nucleicritical

ZoomSounds Plugin - Unauthenticated Arbitrary File Upload

CVE-2021-4449CRITICAL

ZoomSounds <= 5.96 - Unauthenticated Arbitrary File Upload

43RISCO

abrir ↗

Nucleicritical

Zoho ManageEngine Desktop Central - Remote Code Execution

CVE-2021-44515CRITICALsob ataque

Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server

95RISCO

abrir ↗

Nucleimedium

Open Redirect in Host Authorization Middleware

CVE-2021-44528—

A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host"

18RISCO

abrir ↗

Nucleicritical

Ivanti EPM Cloud Services Appliance Code Injection

CVE-2021-44529CRITICALsob ataqueransomware

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execut

100RISCO

abrir ↗

Nucleicritical

Employee Records System 1.0 - Unauthenticated File Upload RCE

CVE-2021-4462CRITICAL

Employee Records System v1.0 Arbitrary File Upload RCE

63RISCO

abrir ↗

Nucleihigh

Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download

CVE-2021-4463HIGH

Longjing Technology BEMS API <= 1.21 Remote Arbitrary File Download

36RISCO

abrir ↗

Nucleimedium

Thinfinity VirtualUI User Enumeration

CVE-2021-44848—

In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication reques

43RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.