Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.211exploits catalogados

36.421CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.464Referência 23.022GitHub PoC 15.027VulnCheck XDB 8.846Nuclei 4.361Metasploit 3.491✓ só verificadosrecentes populares risco

4.358 exploits

Nucleicritical

PHPGurukul Dairy Farm Shop Management System 1.0 - SQL Injection

CVE-2020-5307—

PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username paramet

23RISCO

abrir ↗

Nucleimedium

Spring Cloud Config - Local File Inclusion

CVE-2020-5405—

Directory Traversal with spring-cloud-config-server

30RISCO

abrir ↗

Nucleihigh

Spring Cloud Config Server - Local File Inclusion

CVE-2020-5410HIGHsob ataque

Directory Traversal with spring-cloud-config-server

100RISCO

abrir ↗

Nucleimedium

Spring Cloud Netflix - Server-Side Request Forgery

CVE-2020-5412—

Hystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard

23RISCO

abrir ↗

Nucleicritical

Grandstream UCM6200 - SQL Injection

CVE-2020-5722CRITICALsob ataque

The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafte

100RISCO

abrir ↗

Nucleihigh

SRS Simple Hits Counter 1.0.3-1.0.4 - Unauthenticated Blind SQL Injection

CVE-2020-5766—

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin f

18RISCO

abrir ↗

Nucleimedium

Canvas LMS v2020-07-29 - Blind Server-Side Request Forgery

CVE-2020-5775—

Server-Side Request Forgery in Canvas LMS 2020-07-29 allows a remote, unauthenticated attacker to cause the Canvas appli

18RISCO

abrir ↗

Nucleihigh

MAGMI - Cross-Site Request Forgery

CVE-2020-5776—

Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is poss

23RISCO

abrir ↗

Nucleicritical

Magento Mass Importer <0.7.24 - Remote Auth Bypass

CVE-2020-5777—

MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in t

23RISCO

abrir ↗

Nucleicritical

UnRaid <=6.80 - Remote Code Execution

CVE-2020-5847CRITICALsob ataque

Unraid through 6.8.0 allows Remote Code Execution.

100RISCO

abrir ↗

Nucleicritical

F5 BIG-IP TMUI - Remote Code Execution

CVE-2020-5902CRITICALsob ataqueransomware

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

100RISCO

abrir ↗

Nucleimedium

CLink Office 2.0 - Cross-Site Scripting

CVE-2020-6171—

A cross-site scripting (XSS) vulnerability in the index page of the CLink Office 2.0 management console allows remote at

18RISCO

abrir ↗

Nucleicritical

SAP Solution Manager 7.2 - Remote Command Execution

CVE-2020-6207CRITICALsob ataque

SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform an

100RISCO

abrir ↗

Nucleicritical

SAP NetWeaver AS JAVA 7.30-7.50 - Remote Admin Addition

CVE-2020-6287CRITICALsob ataque

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication c

100RISCO

abrir ↗

Nucleimedium

SAP BusinessObjects Business Intelligence Platform - Blind Server-Side Request Forgery

CVE-2020-6308MEDIUM

SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated at

60RISCO

abrir ↗

Nucleicritical

OpenSIS 7.3 - SQL Injection

CVE-2020-6637—

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php.

23RISCO

abrir ↗

Nucleimedium

Eclipse Mojarra - Local File Read

CVE-2020-6950—

Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or c

23RISCO

abrir ↗

Nucleimedium

WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting

CVE-2020-7107—

The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.

18RISCO

abrir ↗

Nucleicritical

HPE Smart Update Manager < 8.5.6 - Remote Unauthorized Access

CVE-2020-7136—

A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access

40RISCO

abrir ↗

Nucleicritical

LinuxKI Toolset <= 6.01 - Remote Command Execution

CVE-2020-7209—

LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.

60RISCO

abrir ↗

Nucleimedium

McAfee ePolicy Orchestrator <5.10.9 Update 9 - Cross-Site Scripting

CVE-2020-7318MEDIUM

ePolicy Orchistrator (ePO) - Cross-Site Scripting vulnerability

28RISCO

abrir ↗

Nucleicritical

Zimbra Collaboration Suite < 8.8.15 Patch 7 - Server-Side Request Forgery

CVE-2020-7796CRITICALsob ataque

Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enab

95RISCO

abrir ↗

Nucleihigh

Puppet Server/PuppetDB - Sensitive Information Disclosure

CVE-2020-7943—

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For Pup

18RISCO

abrir ↗

Nucleicritical

Liferay Portal Unauthenticated < 7.2.1 CE GA2 - Remote Code Execution

CVE-2020-7961CRITICALsob ataque

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c

100RISCO

abrir ↗

Nucleicritical

Satellian Intellian Aptus Web <= 1.24 - Remote Command Execution

CVE-2020-7980—

Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to th

60RISCO

abrir ↗

Nucleimedium

Revive Adserver <=5.0.3 - Cross-Site Scripting

CVE-2020-8115—

A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver

18RISCO

abrir ↗

Nucleihigh

Ruby on Rails <5.0.1 - Remote Code Execution

CVE-2020-8163—

The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the

60RISCO

abrir ↗

Nucleimedium

Citrix ADC/Gateway - Cross-Site Scripting

CVE-2020-8191—

Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.1

23RISCO

abrir ↗

Nucleimedium

Citrix - Local File Inclusion

CVE-2020-8193MEDIUMsob ataque

Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14

100RISCO

abrir ↗

Nucleimedium

Citrix ADC and Citrix NetScaler Gateway - Remote Code Injection

CVE-2020-8194—

Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.