Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
78.958exploits catalogados
36.206CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8.829Nuclei 4.357Metasploit 3.489✓ só verificadosrecentespopularesrisco
24.460 exploits
Exploit-DB
Apache CouchDB 3.2.1 - Remote Code Execution (RCE)
Remote Code Execution Vulnerability in Packaging
100RISCO
abrir ↗Exploit-DB
MyBB 1.8.29 - MyBB 1.8.29 - Remote Code Execution (RCE) (Authenticated)
Remote code execution in mybb
78RISCO
abrir ↗Exploit-DB
Navigate CMS 2.9.4 - Server-Side Request Forgery (SSRF) (Authenticated)
A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the ap
43RISCO
abrir ↗Exploit-DB
DLINK DAP-1620 A1 v1.01 - Directory Traversal
Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd]
50RISCO
abrir ↗Exploit-DB
Explore CMS 1.0 - SQL Injection
Explore CMS v1.0 was discovered to contain a SQL injection vulnerability via a /page.php?id= request.
23RISCO
abrir ↗Exploit-DB
Gitlab 14.9 - Authentication Bypass
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE
85RISCO
abrir ↗Exploit-DB
GitLab 14.9 - Stored Cross-Site Scripting (XSS)
Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 befor
63RISCO
abrir ↗Exploit-DB
REDCap 11.3.9 - Stored Cross Site Scripting
A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows
23RISCO
abrir ↗Exploit-DB
WordPress Plugin Popup Maker 1.16.5 - Stored Cross-Site Scripting (Authenticated)
Popup Maker < 1.16.5 - Admin+ Stored Cross-Site Scripting
35RISCO
abrir ↗Exploit-DB
Zyxel NWA-1100-NH - Command Injection
A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to exec
70RISCO
abrir ↗Exploit-DB
PKP Open Journals System 3.3 - Cross-Site Scripting (XSS)
Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers to
38RISCO
abrir ↗Exploit-DB
Easy Appointments 1.4.2 - Information Disclosure
Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments
75RISCO
abrir ↗Exploit-DB
Telesquare TLR-2855KS6 - Arbitrary File Deletion
An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system fil
60RISCO
abrir ↗Exploit-DB
Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion (LFI)
Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privilege
50RISCO
abrir ↗Exploit-DB
SAM SUNNY TRIPOWER 5.0 - Insecure Direct Object Reference (IDOR)
Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups acce
33RISCO
abrir ↗Exploit-DB
Telesquare TLR-2855KS6 - Arbitrary File Creation
An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.
43RISCO
abrir ↗Exploit-DB
Sherpa Connector Service v2020.2.20328.2050 - Unquoted Service Path
There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might
23RISCO
abrir ↗Exploit-DB
Kramer VIAware - Remote Code Execution (RCE) (Root)
KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits runn
60RISCO
abrir ↗Exploit-DB
Kramer VIAware - Remote Code Execution (RCE) (Root)
KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePa
50RISCO
abrir ↗Exploit-DB
Kramer VIAware 2.5.0719.1034 - Remote Code Execution (RCE)
Kramer VIAware 2.5.0719.1034 has Incorrect Access Control.
28RISCO
abrir ↗Exploit-DB
WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS
Easy Cookie Policy <= 1.6.2 - Broken Access Control to Stored Cross-Site Scripting
28RISCO
abrir ↗Exploit-DB
ImpressCMS 1.4.2 - Remote Code Execution (RCE)
ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.
43RISCO
abrir ↗Exploit-DB
Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE)
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execut
100RISCO
abrir ↗Exploit-DB
iRZ Mobile Router - CSRF to RCE
A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in
35RISCO
abrir ↗Exploit-DB
Pluck CMS 4.7.16 - Remote Code Execution (RCE) (Authenticated)
In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remot
35RISCO
abrir ↗Exploit-DB
Apache APISIX 2.12.1 - Remote Code Execution (RCE)
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
100RISCO
abrir ↗Exploit-DB
Tiny File Manager 2.4.6 - Remote Code Execution (RCE)
A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to
23RISCO
abrir ↗Exploit-DB
Tiny File Manager 2.4.6 - Remote Code Execution (RCE)
A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7
45RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.