Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
71.957exploits catalogados
32.195CVEs com exploração pública
1.932testados em laboratório
TodosExploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8.182Nuclei 4.217Metasploit 3.462✓ só verificadosrecentespopularesrisco
4.217 exploits
Nucleicritical
Flowise - Remote Code Execution
Flowise has Remote Code Execution vulnerability
85RISCO
abrir ↗Nucleimedium
Ajax Load More < 7.6.1 - Unauthenticated Sensitive Information Exposure
WordPress Ajax Load More Plugin <= 7.6.0.2 - Sensitive Data Exposure Vulnerability
28RISCO
abrir ↗Nucleihigh
WordPress WPvivid Backup & Migration Plugin <= 0.9.116 - Authenticated Arbitrary File Upload
Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload
36RISCO
abrir ↗Nucleimedium
ownCloud Guests - User Enumeration
ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endp
28RISCO
abrir ↗Nucleihigh
Atarim < 4.2.2 - Sensitive Information Exposure
WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability
36RISCO
abrir ↗Nucleicritical
WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
63RISCO
abrir ↗Nucleimedium
DokuWiki <= 2025-05-14a Librarian - Reflected Cross-Site Scripting
Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitra
28RISCO
abrir ↗Nucleihigh
Traccar(Windows) 6.1- 6.8.1 - Local File Inclusion
Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File
36RISCO
abrir ↗Nucleimedium
WordPress Qwizcards < 3.95 - Cross-Site Scripting (Reflected)
WordPress Qwizcards <= 3.9.4 - Reflected XSS
28RISCO
abrir ↗Nucleicritical
Oracle Identity Manager REST WebServices - Authentication Bypass
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported vers
100RISCO
abrir ↗Nucleicritical
Oracle E-Business Suite 12.2.3–12.2.14 – Remote Code Execution
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integratio
100RISCO
abrir ↗Nucleihigh
Oracle E-Business Suite - Server-Side Request Forgery
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions
100RISCO
abrir ↗Nucleimedium
Open Redirect via Organization Switching
An open redirect vulnerability has been identified in Grafana OSS organization switching functionality.
Prerequisites
28RISCO
abrir ↗Nucleicritical
ChanCMS <= 3.1. - Remote Code Execution
yanyutao0402 ChanCMS collect.js getArticle deserialization
28RISCO
abrir ↗Nucleimedium
LibreChat <= 0.7.9 - HTML Injection via Accept-Language Header
HTML Injection in Accept-Language Header in danny-avila/librechat
28RISCO
abrir ↗Nucleicritical
Chef Automate < 4.13.295 — SQL Injection
Chef Automate compliance service SQL Injection Vulnerability
48RISCO
abrir ↗Nucleicritical
Flowise < 3.0.1 - Remote Command Execution
Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers
65RISCO
abrir ↗Nucleimedium
Trinity Audio <= 5.21.0 - Information Exposure
Trinity Audio <= 5.21.0 - Unauthenticated Information Exposure
28RISCO
abrir ↗Nucleicritical
RestroPress 3.0.0-3.2.1 - Authentication Bypass
RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT
63RISCO
abrir ↗Nucleimedium
N-central - Authentication Bypass
N-central unauthenticated sessionID generation
60RISCO
abrir ↗Nucleicritical
Loan Management System 1.0 - SQL Injection
Campcodes Online Loan Management System ajax.php sql injection
28RISCO
abrir ↗Nucleimedium
The Events Calendar <= 6.15.2 - Information Disclosure
The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure
28RISCO
abrir ↗Nucleimedium
Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File
Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File
33RISCO
abrir ↗Nucleicritical
MLflow Job API - Authentication Bypass
Missing Authentication for Critical Function in mlflow/mlflow
36RISCO
abrir ↗Nucleihigh
LolLMS < 2.2.0 - Server-Side Request Forgery
Server-Side Request Forgery (SSRF) in parisneo/lollms
36RISCO
abrir ↗Nucleimedium
WordPress List Site Contributors < 1.1.8 - Reflected XSS
List Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alpha
28RISCO
abrir ↗Nucleicritical
Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
75RISCO
abrir ↗Nucleicritical
Langflow < 1.3.0 - Remote Code Execution via validate_code() exec()
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
100RISCO
abrir ↗Nucleihigh
Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending
Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending
28RISCO
abrir ↗Nucleicritical
Prodigy Commerce <= 3.3.0 - Local File Inclusion
Prodigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]
63RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.