Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
78.958exploits catalogados
36.206CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8.829Nuclei 4.357Metasploit 3.489✓ só verificadosrecentespopularesrisco
24.460 exploits
Exploit-DB✓ VexDay Proof
NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi
NEX-Forms < 7.9.7 - Authenticated SQLi
43RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Abantecart v1.3.2 - Authenticated Remote Code Execution
Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution
SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting
23RISCO
abrir ↗Exploit-DB
DLink DIR 819 A1 - Denial of Service
On D-Link DIR-819 Firmware Version 1.06 Hardware Version A1 devices, it is possible to trigger a Denial of Service via t
41RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Bus Pass Management System 1.0 - Cross-Site Scripting (XSS)
Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the s
33RISCO
abrir ↗Exploit-DB
Password Manager for IIS v2.0 - XSS
Password Manager for IIS 2.0 has a cross-site scripting (XSS) vulnerability via the /isapi/PasswordManager.dll ResultURL
33RISCO
abrir ↗Exploit-DB
ImpressCMS v1.4.3 - Authenticated SQL Injection
SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this al
23RISCO
abrir ↗Exploit-DB
NVFLARE < 2.1.4 - Unsafe Deserialization due to Pickle
NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage ma
53RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Composr-CMS Version <=10.0.39 - Authenticated Remote Code Execution
Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrar
23RISCO
abrir ↗Exploit-DB
Bitbucket v7.0.0 - RCE
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
100RISCO
abrir ↗Exploit-DB
wkhtmltopdf 0.12.6 - Server Side Request Forgery
wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by inje
28RISCO
abrir ↗Exploit-DB
MAN-EAM-0003 V3.2.4 - XXE
cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file uplo
56RISCO
abrir ↗Exploit-DB
Linksys AX3200 V1.1.00 - Command Injection
Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagn
46RISCO
abrir ↗Exploit-DB
pfBlockerNG 2.1.4_26 - Remote Code Execution (RCE)
pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metachar
85RISCO
abrir ↗Exploit-DB
SmartRG Router SR510n 2.6.13 - Remote Code Execution
SmartRG SR506n 2.5.15 and SR510n 2.6.13 routers are vulnerable to Remote Code Execution (RCE) via the ping host feature.
35RISCO
abrir ↗Exploit-DB
CVAT 2.0 - Server Side Request Forgery
Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)
53RISCO
abrir ↗Exploit-DB
AVEVA InTouch Access Anywhere Secure Gateway 2020 R2 - Path Traversal
AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an
68RISCO
abrir ↗Exploit-DB
Open Web Analytics 1.7.3 - Remote Code Execution
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, wh
60RISCO
abrir ↗Exploit-DB
MSNSwitch Firmware MNT.2408 - Remote Code Execution
An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technolog
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Wordpress Plugin Zephyr Project Manager 3.2.42 - Multiple SQLi
Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi
28RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Wordpress Plugin WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS)
WP-UserOnline <= 2.88.0 - Authenticated (Admin+) Stored Cross-Site Scripting
33RISCO
abrir ↗Exploit-DB
Feehi CMS 2.1.1 - Remote Code Execution (Authenticated)
A stored cross-site scripting (XSS) vulnerability in /index.php?r=site%2Fsignup of Feehi CMS v2.1.1 allows attackers to
23RISCO
abrir ↗Exploit-DB
Teleport v10.1.1 - Remote Code Execution (RCE)
Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ss
35RISCO
abrir ↗Exploit-DB
TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE)
TP-LINK Tapo C200 remote code execution vulnerability
70RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Bookwyrm v0.4.3 - Authentication Bypass
Authentication Bypass by Primary Weakness in bookwyrm-social/bookwyrm
53RISCO
abrir ↗Exploit-DB
Blink1Control2 2.2.7 - Weak Password Encryption
The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage.
23RISCO
abrir ↗Exploit-DB
Airspan AirSpot 5410 version 0.3.4.1 - Remote Code Execution (RCE)
In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerabilit
35RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Gitea 1.16.6 - Remote Code Execution (RCE) (Metasploit)
Gitea before 1.16.7 does not escape git fetch remote.
60RISCO
abrir ↗Exploit-DB
PAN-OS 10.0 - Remote Code Execution (RCE) (Authenticated)
PAN-OS: OS command injection vulnerability in the management web interface
78RISCO
abrir ↗Exploit-DB
ThingsBoard 3.3.1 'name' - Stored Cross-Site Scripting (XSS)
A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrat
23RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.