Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.957exploits catalogados

32.195CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8.182Nuclei 4.217Metasploit 3.462✓ só verificadosrecentes populares risco

4.217 exploits

Nucleimedium

MooDating 1.2 - Cross-Site Scripting

CVE-2023-3845LOW

mooSocial mooDating URL ajax_invite cross site scripting

43RISCO

abrir ↗

Nucleimedium

MooDating 1.2 - Cross-Site Scripting

CVE-2023-3846LOW

mooSocial mooDating URL pages cross site scripting

43RISCO

abrir ↗

Nucleimedium

MooDating 1.2 - Cross-Site scripting

CVE-2023-3847LOW

mooSocial mooDating URL users cross site scripting

43RISCO

abrir ↗

Nucleimedium

MooDating 1.2 - Cross-site scripting

CVE-2023-3848LOW

mooSocial mooDating URL view cross site scripting

43RISCO

abrir ↗

Nucleimedium

mooDating 1.2 - Cross-site scripting

CVE-2023-3849LOW

mooSocial mooDating URL find-a-match cross site scripting

43RISCO

abrir ↗

Nucleimedium

CopyParty v1.8.6 - Cross Site Scripting

CVE-2023-38501MEDIUM

copyparty vulnerable to reflected cross-site scripting via k304 parameter

48RISCO

abrir ↗

Nucleicritical

Metabase < 0.46.6.1 - Remote Code Execution

CVE-2023-38646—

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary comman

60RISCO

abrir ↗

Nucleimedium

PHP Login System 2.0.1 - Cross-Site Scripting

CVE-2023-38875—

A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to ex

18RISCO

abrir ↗

Nucleihigh

openSIS v9.0 - Path Traversal

CVE-2023-38879—

The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a direc

18RISCO

abrir ↗

Nucleihigh

ZKTeco BioTime v8.5.5 - Path Traversal

CVE-2023-38950HIGHsob ataque

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbit

100RISCO

abrir ↗

Nucleihigh

ZKTeco BioTime <= 9.0.1 - Privilege Escalation

CVE-2023-38952HIGH

Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due

36RISCO

abrir ↗

Nucleimedium

Academy LMS 6.0 - Cross-Site Scripting

CVE-2023-38964—

Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability.

18RISCO

abrir ↗

Nucleicritical

Jeecg-Boot v3.5.1 - SQL Injection

CVE-2023-38992—

jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeD

40RISCO

abrir ↗

Nucleimedium

OPNsense - Cross-Site Scripting

CVE-2023-39002—

A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition

18RISCO

abrir ↗

Nucleicritical

OPNsense - Cross-Site Scripting to RCE

CVE-2023-39007—

/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 al

18RISCO

abrir ↗

Nucleihigh

FileMage Gateway - Directory Traversal

CVE-2023-39026—

Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker t

43RISCO

abrir ↗

Nucleihigh

rConfig 3.9.4 - Server-Side Request Forgery

CVE-2023-39108—

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Fun

18RISCO

abrir ↗

Nucleihigh

rConfig 3.9.4 - Server-Side Request Forgery

CVE-2023-39109—

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Fun

18RISCO

abrir ↗

Nucleihigh

rConfig 3.9.4 - Server-Side Request Forgery

CVE-2023-39110—

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPa

18RISCO

abrir ↗

Nucleihigh

Emlog 2.1.9 - SQL Injection

CVE-2023-39121—

emlog v2.1.9 was discovered to contain a SQL injection vulnerability via the component /admin/user.php.

18RISCO

abrir ↗

Nucleihigh

Aria2 WebUI - Path traversal

CVE-2023-39141—

webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability.

18RISCO

abrir ↗

Nucleicritical

PaperCut < 22.1.3 - Path Traversal

CVE-2023-39143CRITICAL

PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete

85RISCO

abrir ↗

Nucleimedium

Blog2Social < 7.2.1 - Cross-Site Scripting

CVE-2023-3936MEDIUM

Blog2Social < 7.2.1 - Reflected XSS

28RISCO

abrir ↗

Nucleicritical

Cacti 1.2.24 - SQL Injection

CVE-2023-39361CRITICAL

Unauthenticated SQL Injection in graph_view.php in Cacti

85RISCO

abrir ↗

Nucleicritical

ECTouch v2 - SQL Injection

CVE-2023-39560—

ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr['id'] parameter at \default\helpers\inse

18RISCO

abrir ↗

Nucleimedium

IceWarp Email Client - Cross Site Scripting

CVE-2023-39598—

Cross Site Scripting vulnerability in IceWarp Corporation WebClient v.10.2.1 allows a remote attacker to execute arbitra

18RISCO

abrir ↗

Nucleicritical

Anyscale Ray 2.6.3 and 2.8.0 - Server-Side Request Forgery

CVE-2023-48023CRITICAL

Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant becau

55RISCO

abrir ↗

Nucleicritical

Nagios XI < 5.11.3 - SQL Injection

CVE-2023-48084—

Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool.

50RISCO

abrir ↗

Nucleihigh

XWiki < 4.10.15 - Information Disclosure

CVE-2023-48241HIGH

XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service

58RISCO

abrir ↗

Nucleimedium

WWBN AVideo 11.6 - Cross-Site Scripting

CVE-2023-48728CRITICAL

A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.

43RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.