Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
78.958exploits catalogados
36.206CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8.829Nuclei 4.357Metasploit 3.489✓ só verificadosrecentespopularesrisco
24.460 exploits
Exploit-DB
Wordpress Plugin wpDiscuz 7.0.4 - Arbitrary File Upload (Unauthenticated)
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo
85RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Rocket.Chat 3.12.1 - NoSQL Injection (Unauthenticated)
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
60RISCO
abrir ↗Exploit-DB
Grav CMS 1.7.10 - Server-Side Template Injection (SSTI) (Authenticated)
Twig allowing dangerous PHP functions by default
53RISCO
abrir ↗Exploit-DB
IcoFX 2.6 - '.ico' Buffer Overflow SEH + DEP Bypass using JOP
Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCoun
50RISCO
abrir ↗Exploit-DB
Monstra CMS 3.0.4 - Remote Code Execution (Authenticated)
Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but
28RISCO
abrir ↗Exploit-DB
FUDForum 3.1.0 - 'author' Reflected XSS
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "
38RISCO
abrir ↗Exploit-DB
4Images 1.8 - 'redirect' Reflected XSS
A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to in
23RISCO
abrir ↗Exploit-DB
CHIYU IoT Devices - Denial of Service (DoS)
A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including B
35RISCO
abrir ↗Exploit-DB
FUDForum 3.1.0 - 'srch' Reflected XSS
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "
38RISCO
abrir ↗Exploit-DB
CHIYU IoT Devices - 'Telnet' Authentication Bypass
An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Tec
35RISCO
abrir ↗Exploit-DB
Seo Panel 4.8.0 - 'from_time' Reflected XSS
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and th
23RISCO
abrir ↗Exploit-DB
GetSimple CMS 3.3.4 - Information Disclosure
GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<user
28RISCO
abrir ↗Exploit-DB
Seo Panel 4.8.0 - 'search_name' Reflected XSS
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and t
23RISCO
abrir ↗Exploit-DB
Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but th
100RISCO
abrir ↗Exploit-DB
Products.PluggableAuthService 2.6.0 - Open Redirect
URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService
33RISCO
abrir ↗Exploit-DB
Seo Panel 4.8.0 - 'category' Reflected XSS
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and
23RISCO
abrir ↗Exploit-DB
Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was disco
100RISCO
abrir ↗Exploit-DB
LogonTracer 1.2.0 - Remote Code Execution (Unauthenticated)
LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
PHPFusion 9.03.50 - Remote Code Execution
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a cr
50RISCO
abrir ↗Exploit-DB
Trixbox 2.8.0.4 - 'lang' Path Traversal
trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter
50RISCO
abrir ↗Exploit-DB
Trixbox 2.8.0.4 - 'lang' Remote Code Execution (Unauthenticated)
trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php
50RISCO
abrir ↗Exploit-DB
WordPress Plugin LifterLMS 4.21.0 - Stored Cross-Site Scripting (XSS)
LifterLMS < 4.21.1 - Authenticated Stored XSS in Edit Profile
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Pluck CMS 4.7.13 - File Upload Remote Code Execution (Authenticated)
A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access
35RISCO
abrir ↗Exploit-DB
Codiad 2.8.4 - Remote Code Execution (Authenticated) (3)
Codiad 2.8.4 allows remote authenticated administrators to execute arbitrary code by uploading an executable file.
28RISCO
abrir ↗Exploit-DB
WordPress Plugin ReDi Restaurant Reservation 21.0307 - 'Comment' Stored Cross-Site Scripting (XSS)
ReDi Restaurant Reservations < 21.0426 - Unauthenticated Stored Cross-Site Scripting (XSS)
23RISCO
abrir ↗Exploit-DB
DELL dbutil_2_3.sys 2.3 - Arbitrary Write to Local Privilege Escalation (LPE)
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
100RISCO
abrir ↗Exploit-DB
Solaris SunSSH 11.0 x86 - libpam Remote Root (2)
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported ve
100RISCO
abrir ↗Exploit-DB
Microsoft Exchange 2019 - Unauthenticated Email Download (Metasploit)
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISCO
abrir ↗Exploit-DB
WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS)
Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS)
38RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.