Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.211exploits catalogados

36.421CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.464Referência 23.022GitHub PoC 15.027VulnCheck XDB 8.846Nuclei 4.361Metasploit 3.491✓ só verificadosrecentes populares risco

4.358 exploits

Nucleimedium

Cisco ASA/FTD Software - Cross-Site Scripting

CVE-2020-3580MEDIUMsob ataqueransomware

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities

100RISCO

abrir ↗

Nucleicritical

Agentejo Cockpit < 0.11.2 - NoSQL Injection

CVE-2020-35846—

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.

40RISCO

abrir ↗

Nucleicritical

Agentejo Cockpit <0.11.2 - NoSQL Injection

CVE-2020-35847—

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.

60RISCO

abrir ↗

Nucleicritical

Agentejo Cockpit <0.12.0 - NoSQL Injection

CVE-2020-35848—

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.

60RISCO

abrir ↗

Nucleicritical

Wordpress Quiz and Survey Master <7.0.1 - Arbitrary File Deletion

CVE-2020-35951CRITICAL

An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbit

65RISCO

abrir ↗

Nucleimedium

Rukovoditel <= 2.7.2 - Cross Site Scripting

CVE-2020-35984—

A stored cross site scripting (XSS) vulnerability in the 'Users Alerts' feature of Rukovoditel 2.7.2 allows authenticate

18RISCO

abrir ↗

Nucleimedium

Rukovoditel <= 2.7.2 - Cross Site Scripting

CVE-2020-35985—

A stored cross site scripting (XSS) vulnerability in the 'Global Lists" feature of Rukovoditel 2.7.2 allows authenticate

18RISCO

abrir ↗

Nucleimedium

Rukovoditel <= 2.7.2 - Cross Site Scripting

CVE-2020-35986—

A stored cross site scripting (XSS) vulnerability in the 'Users Access Groups' feature of Rukovoditel 2.7.2 allows authe

18RISCO

abrir ↗

Nucleimedium

Rukovoditel <= 2.7.2 - Cross-Site Scripting

CVE-2020-35987—

A stored cross site scripting (XSS) vulnerability in the 'Entities List' feature of Rukovoditel 2.7.2 allows authenticat

18RISCO

abrir ↗

Nucleicritical

CSE Bookstore 1.0 - SQL Injection

CVE-2020-36112—

CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pub

23RISCO

abrir ↗

Nucleicritical

Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta

CVE-2020-36155CRITICAL

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalat

43RISCO

abrir ↗

Nucleimedium

Jira Server and Data Center - Information Disclosure

CVE-2020-36289MEDIUM

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Infor

50RISCO

abrir ↗

Nucleicritical

ThemeGrill Demo Importer < 1.6.2 - Database Reset

CVE-2020-36333—

themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a reset_wizard

18RISCO

abrir ↗

Nucleimedium

Smartstore <4.1.0 - Open Redirect

CVE-2020-36365—

Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication,

18RISCO

abrir ↗

Nucleimedium

WordPress 15Zine <3.3.0 - Cross-Site Scripting

CVE-2020-36510—

15Zine < 3.3.0 - Reflected Cross-Site Scripting

18RISCO

abrir ↗

Nucleicritical

Adning Advertising <= 1.5.5 - Arbitrary File Upload

CVE-2020-36705CRITICAL

Adning Advertising <= 1.5.5 - Arbitrary File Upload

43RISCO

abrir ↗

Nucleicritical

WordPress Epsilon Framework Themes <=2.4.8 - Remote Code Execution

CVE-2020-36708CRITICAL

Epsilon Framework Themes (Various Versions) - Function Injection

75RISCO

abrir ↗

Nucleicritical

ListingPro < 2.6.1 - Arbitrary Plugin Installation/Activation/Deactivation

CVE-2020-36719CRITICAL

ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Arbitrary Plugin Installation, Activation and Deactivation

43RISCO

abrir ↗

Nucleihigh

ListingPro < 2.6.1 - Sensitive Data Disclosure

CVE-2020-36723MEDIUM

ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information Disclosure

28RISCO

abrir ↗

Nucleimedium

WordPress Plugin Adning Advertising < 1.5.6 - Arbitrary File Upload

CVE-2020-36728MEDIUM

Adning Advertising <= 1.5.5 - Unauthenticated Arbitrary File Deletion via Path Traversal

28RISCO

abrir ↗

Nucleihigh

Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update

CVE-2020-36731HIGH

Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update

36RISCO

abrir ↗

Nucleihigh

WordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletion

CVE-2020-36836HIGH

WP Fastest Cache <= 0.9.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion

36RISCO

abrir ↗

Nucleimedium

BrightSign Digital Signage 8.2.26 - Server-Side Request Forgery

CVE-2020-36884MEDIUM

BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF

28RISCO

abrir ↗

Nucleicritical

Pinger 1.0 - Remote Code Execution

CVE-2020-37123CRITICAL

Pinger 1.0 - Remote Code Execution

63RISCO

abrir ↗

Nucleicritical

VMware vCenter Server LDAP Broken Access Control

CVE-2020-3952CRITICALsob ataque

Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Servi

100RISCO

abrir ↗

Nucleicritical

IBM Data Risk Manager - Authentication Bypass via SAML

CVE-2020-4427CRITICALsob ataque

IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security rest

95RISCO

abrir ↗

Nucleihigh

IBM Maximo Asset Management Information Disclosure - XML External Entity Injection

CVE-2020-4463HIGH

IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when proc

68RISCO

abrir ↗

Nucleimedium

PHPGurukul Hospital Management System - Cross-Site Scripting

CVE-2020-5191—

PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple Persistent XSS vulnerabilities.

38RISCO

abrir ↗

Nucleihigh

Hospital Management System 4.0 - SQL Injection

CVE-2020-5192—

PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilities: multiple pages an

43RISCO

abrir ↗

Nucleimedium

Next.js <9.3.2 - Local File Inclusion

CVE-2020-5284MEDIUM

Directory Traversal in Next.js versions below 9.3.2

40RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.