Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
78.794exploits catalogados
36.057CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.459Referência 22.721GitHub PoC 14.946VulnCheck XDB 8.829Nuclei 4.350Metasploit 3.489✓ só verificadosrecentespopularesrisco
3.489 exploits
Metasploit600
MagnusBilling application unauthenticated Remote Command Execution.
Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary com
85RISCO
abrir ↗Metasploit600
Rudder Server SQLI Remote Code Execution
rudder-server vulnerable to SQL Injection
58RISCO
abrir ↗Metasploit600
Apache NiFi H2 Connection String Remote Code Execution
Apache NiFi: Potential Code Injection with Database Services using H2
48RISCO
abrir ↗Metasploit300
MongoDB Ops Manager Diagnostic Archive Sensitive Information Retriever
MongoDB Ops Manager may disclose sensitive information in Diagnostic Archive
23RISCO
abrir ↗Metasploit600
CmsMadeSimple Authenticated File Manager RCE
CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.
30RISCO
abrir ↗Metasploit600
Ivanti EPM Agent Portal Command Execution
A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege es
41RISCO
abrir ↗Metasploit600
VMWare Aria Operations for Networks (vRealize Network Insight) pre-authenticated RCE
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware
100RISCO
abrir ↗Metasploit600
Splunk "edit_user" Capability Privilege Escalation
‘edit_user’ Capability Privilege Escalation
78RISCO
abrir ↗Metasploit600
Chamilo unauthenticated command injection in PowerPoint upload
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to ex
60RISCO
abrir ↗Metasploit600
MOVEit SQL Injection vulnerability
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
100RISCO
abrir ↗Metasploit600
Wordpress File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution through shortcode
File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode
50RISCO
abrir ↗Metasploit600
Dolibarr ERP/CRM Authenticated Code Injection
Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instea
58RISCO
abrir ↗Metasploit600
Openfire authentication bypass with RCE plugin
Openfire administration console authentication bypass
100RISCO
abrir ↗Metasploit600
Barracuda ESG TAR Filename Command Injection
Remote Code injection in Barracuda Email Security Gateway
100RISCO
abrir ↗Metasploit600
Apache RocketMQ update config RCE
Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function
100RISCO
abrir ↗Metasploit300
GitLab Authenticated File Read
An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a
85RISCO
abrir ↗Metasploit600
SolarView Compact unauthenticated remote command execution vulnerability.
There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassin
85RISCO
abrir ↗Metasploit600
TOTOLINK Wireless Routers unauthenticated remote command execution vulnerability.
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/s
68RISCO
abrir ↗Metasploit600
Sharepoint Dynamic Proxy Generator Unauth RCE
Microsoft SharePoint Server Remote Code Execution Vulnerability
100RISCO
abrir ↗Metasploit600
Sharepoint Dynamic Proxy Generator Unauth RCE
Microsoft SharePoint Server Elevation of Privilege Vulnerability
100RISCO
abrir ↗Metasploit300
Apache Superset Signed Cookie Priv Esc
Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
100RISCO
abrir ↗Metasploit600
Ivanti Avalanche FileStoreConfig File Upload
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could
58RISCO
abrir ↗Metasploit300
Piwigo CVE-2023-26876 Gather Credentials via SQL Injection
SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via t
36RISCO
abrir ↗Metasploit600
ManageEngine ADManager Plus ChangePasswordAction Authenticated Command Injection
Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy setti
58RISCO
abrir ↗Metasploit400
Windows Common Log File System Driver (clfs.sys) Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
98RISCO
abrir ↗Metasploit300
CVE-2023-21554 - QueueJumper - MSMQ RCE Check
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
85RISCO
abrir ↗Metasploit300
Jasmin Ransomware Web Server Unauthenticated Directory Traversal
Directory Traversal vulnerability in codesiddhant Jasmin Ransomware v.1.0.1 allows an attacker to obtain sensitive infor
28RISCO
abrir ↗Metasploit300
Jasmin Ransomware Web Server Unauthenticated SQL Injection
codesiddhant Jasmin Ransomware checklogin.php sql injection
28RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.