Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
71.957exploits catalogados
32.195CVEs com exploração pública
1.932testados em laboratório
TodosExploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8.182Nuclei 4.217Metasploit 3.462✓ só verificadosrecentespopularesrisco
4.217 exploits
Nucleimedium
Bootstrap Multiselect <= 1.1.2 - Cross-Site Scripting
An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the sour
28RISCO
abrir ↗Nucleicritical
Advantech WISE-IoTSuite/SaaS - SQL Injection
Execution of arbitrary SQL commands
75RISCO
abrir ↗Nucleihigh
Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection
Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection
56RISCO
abrir ↗Nucleihigh
Fortinet FortiWeb - Authentication Bypass to Admin Privilege
A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.
56RISCO
abrir ↗Nucleimedium
ONLYOFFICE Docs (DocumentServer) - Reflected Cross-Site Scripting
Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)
40RISCO
abrir ↗Nucleicritical
Securden Unified PAM - Authentication Bypass
Securden Unified PAM Authentication Bypass
48RISCO
abrir ↗Nucleimedium
Parse Server - GraphQL Schema Information Disclosure
Parse Server exposes the data schema via GraphQL API
28RISCO
abrir ↗Nucleimedium
WSO2 - Server Side Request Forgery
SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
28RISCO
abrir ↗Nucleimedium
Pi-hole Reflected XSS in 404-Error Page
Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page
28RISCO
abrir ↗Nucleihigh
ZTE ZXHN-F660T/F660A - Default Credentials
ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge o
56RISCO
abrir ↗Nucleihigh
Docusaurus Gists Plugin < 4.0.0 - GitHub Personal Access Token Exposure
docusaurus-plugin-content-gists Exposes GitHub Personal Access Token
43RISCO
abrir ↗Nucleicritical
Microsoft SharePoint Server - Remote Code Execution (ToolShell)
Microsoft SharePoint Server Remote Code Execution Vulnerability
100RISCO
abrir ↗Nucleimedium
Microsoft SharePoint Server - Authentication Bypass (ToolShell)
Microsoft SharePoint Server Spoofing Vulnerability
50RISCO
abrir ↗Nucleicritical
LaRecipe < 2.8.1 Remote Code Execution via SSTI
LaRecipe is vulnerable to Server-Side Template Injection attacks
63RISCO
abrir ↗Nucleicritical
Unauthenticated Arbitrary Plugin Upload in Alone Theme
Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
75RISCO
abrir ↗Nucleicritical
Laravel Livewire v3 - Remote Command Execution
Livewire vulnerable to remote command execution during property update hydration
100RISCO
abrir ↗Nucleicritical
Hoverfly <= 1.11.3 - Remote Code Execution
Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation
68RISCO
abrir ↗Nucleihigh
XWiki XML View - Sensitive Information Exposure
XWiki Platform: Password and email exposure in xml.vm fields
36RISCO
abrir ↗Nucleicritical
Adobe Commerce - Authentication Bypass
Adobe Commerce | Improper Input Validation (CWE-20)
100RISCO
abrir ↗Nucleimedium
Adobe Experience Manager ≤ 6.5.23.0 – SSRF
Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)
28RISCO
abrir ↗Nucleimedium
Adobe Experience Manager ≤ 6.5.23.0 - XML Injection
Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)
28RISCO
abrir ↗Nucleimedium
Copyparty <=1.18.6 - Cross-Site Scripting
copyparty Reflected XSS via Filter Parameter
48RISCO
abrir ↗Nucleimedium
Heimdall Application Dashboard < 2.7.3 - Reflected XSS
LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.
36RISCO
abrir ↗Nucleihigh
WordPress JS Archive List <= 6.1.5 - SQL Injection
WordPress JS Archive List Plugin < 6.1.6 - SQL Injection Vulnerability
63RISCO
abrir ↗Nucleicritical
NestJS DevTools Integration - Remote Code Execution
@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers
75RISCO
abrir ↗Nucleimedium
Astro SSR - Open Redirect
Astro: Duplicate trailing slash feature can lead to Open Redirects
28RISCO
abrir ↗Nucleihigh
Stirling-PDF < 1.1.0 - Server-Side Request Forgery
Stirling-PDF SSRF vulnerability on /api/v1/convert/html/pdf
36RISCO
abrir ↗Nucleihigh
Stirling-PDF SSRF via Markdown
Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf
36RISCO
abrir ↗Nucleicritical
WeGIA - Directory Traversal
WeGIA Path Traversal at endpoint 'html/socio/sistema/download_remessa.php' via parameter 'file'
43RISCO
abrir ↗Nucleicritical
React Server Components - Remote Code Execution
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.