Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
76.066exploits catalogados
34.679CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.443Referência 21.692GitHub PoC 13.771VulnCheck XDB 8.460Nuclei 4.233Metasploit 3.467✓ só verificadosrecentespopularesrisco
75.902 exploits
VulnCheck XDB
initial-access
GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not
50RISCO
abrir ↗Exploit-DB
phpMyFAQ 3.2.10 - Unintended File Download Triggered by Embedded Frames
phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames
33RISCO
abrir ↗Exploit-DB
FLIR AX8 1.46.16 - Remote Command Injection
All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This
60RISCO
abrir ↗VulnCheck XDB
infoleak
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
100RISCO
abrir ↗VulnCheck XDB
initial-access
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISCO
abrir ↗Exploit-DB
Ethercreative Logs 3.0.3 - Path Traversal
The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in
28RISCO
abrir ↗Exploit-DB
NagVis 1.9.33 - Arbitrary File Read
Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagV
48RISCO
abrir ↗Exploit-DB
Smart Manager 8.27.0 - Post-Authenticated SQL Injection
Smart Manager < 8.28.0 - Admin+ SQL Injection
41RISCO
abrir ↗Exploit-DB
Garage Management System 1.0 (categoriesName) - Stored XSS
A stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrary
33RISCO
abrir ↗Exploit-DB
Car Rental Project 1.0 - Remote Code Execution
PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile ima
23RISCO
abrir ↗Exploit-DB
Fortinet FortiOS_ FortiProxy_ and FortiSwitchManager 7.2.0 - Authentication bypass
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
100RISCO
abrir ↗Exploit-DB
phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting (XSS)
Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
48RISCO
abrir ↗Exploit-DB
ProConf 6.0 - Insecure Direct Object Reference (IDOR)
In ProConf before 6.1, an Insecure Direct Object Reference (IDOR) allows any author to view and grab all submitted paper
23RISCO
abrir ↗Exploit-DB
Ruckus IoT Controller 1.7.1.0 - Undocumented Backdoor Account
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. An Undocumented Backdoor exists, allowin
28RISCO
abrir ↗Exploit-DB
Dell EMC iDRAC7/iDRAC8 2.52.52.52 - Remote Code Execution (RCE)
Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute
60RISCO
abrir ↗GitHub PoC★ 1
This is a proof of concept of the critical WinBox vulnerability (CVE-2018-14847) which allows for arbitrary file read of plain text passwords. The vulnerability has long since been fixed, so this project has ended and will not be supported or updated anymore. You can fork it and update it yourself instead.
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
100RISCO
abrir ↗GitHub PoC★ 10
verylazytech/CVE-2025-3248
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISCO
abrir ↗Exploit-DB
WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection
WooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injection
41RISCO
abrir ↗Exploit-DB
Cacti 1.2.26 - Remote Code Execution (RCE) (Authenticated)
Cacti RCE vulnerability when importing packages
85RISCO
abrir ↗Exploit-DB
Ivanti Connect Secure 22.7R2.5 - Remote Code Execution (RCE)
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7
100RISCO
abrir ↗Exploit-DB
Pymatgen 2024.1 - Remote Code Execution (RCE)
pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string
48RISCO
abrir ↗Exploit-DB
OpenCMS 17.0 - Stored Cross Site Scripting (XSS)
XWiki Platform XSS through conflict resolution
48RISCO
abrir ↗Exploit-DB
ABB Cylon Aspect 3.07.02 (userManagement.php) - Weak Password Policy
Weak Password Rules/Strength
48RISCO
abrir ↗VulnCheck XDB
infoleak
GLPI allows unauthenticated SQL injection through the inventory endpoint
78RISCO
abrir ↗VulnCheck XDB
infoleak
Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion
85RISCO
abrir ↗GitHub PoC
CVE-2019-9053.
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve
35RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.