Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.057exploits catalogados

36.288CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.460Referência 22.910GitHub PoC 14.997VulnCheck XDB 8.843Nuclei 4.358Metasploit 3.489✓ só verificadosrecentes populares risco

22.910 exploits

Referência

CVE-2021-44848

CVE-2021-44848—

In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication reques

43RISCO

abrir ↗

Referência✓ VexDay Proof

OpenImpro 1.1 - 'image.php' SQL Injection

CVE-2008-3599—webappsphp

SQL injection vulnerability in image.php in OpenImpro 1.1 allows remote attackers to execute arbitrary SQL commands via

23RISCO

abrir ↗

Referência✓ VexDay Proof

Yahoo! Messenger Webcam 8.1 - ActiveX Remote Buffer Overflow

CVE-2007-3147—remotewindows

Buffer overflow in the Yahoo! Webcam Upload ActiveX control in ywcupl.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows

50RISCO

abrir ↗

Referência✓ VexDay Proof

Userlocator 3.0 - Blind SQL Injection

CVE-2008-5863—webappsphp

SQL injection vulnerability in locator.php in the Userlocator module 3.0 for Woltlab Burning Board (wBB) allows remote a

23RISCO

abrir ↗

Referência✓ VexDay Proof

BlogHelper - Remote Configuration File Disclosure

CVE-2009-0826—webappsphp

BlogHelper stores common_db.inc under the web root with insufficient access control, which allows remote attackers to do

23RISCO

abrir ↗

Referência

CVE-2012-4891

CVE-2012-4891—

Cross-site scripting (XSS) vulnerability in fw/index2.do in ManageEngine Firewall Analyzer 7.2 allows remote attackers t

23RISCO

abrir ↗

Referência

CVE-2019-7256

CVE-2019-7256CRITICALsob ataque

Linear eMerge E3-Series devices allow Command Injections.

100RISCO

abrir ↗

Referência✓ VexDay Proof

Quicksilver Forums 1.4.1 - SQL Injection

CVE-2008-3601—webappsphp

SQL injection vulnerability in index.php in Quicksilver Forums 1.4.1 allows remote attackers to execute arbitrary SQL co

23RISCO

abrir ↗

Referência✓ VexDay Proof

Vacation Rental Script 3.0 - 'id' SQL Injection

CVE-2008-3603—webappsphp

SQL injection vulnerability in index.php in Vacation Rental Script 3.0 allows remote attackers to execute arbitrary SQL

23RISCO

abrir ↗

Referência

CVE-2019-7276

CVE-2019-7276—

Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console.

60RISCO

abrir ↗

Referência

CVE-2014-5073

CVE-2014-5073—

vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands

60RISCO

abrir ↗

Referência

snapd < 2.37 (Ubuntu) - 'dirty_sock' Local Privilege Escalation (1)

CVE-2019-7304HIGHlocallinux

Local privilege escalation via snapd socket

53RISCO

abrir ↗

Referência

snapd < 2.37 (Ubuntu) - 'dirty_sock' Local Privilege Escalation (2)

CVE-2019-7304HIGHlocallinux

Local privilege escalation via snapd socket

53RISCO

abrir ↗

Referência

CVE-2021-45092

CVE-2021-45092—

Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection vi

50RISCO

abrir ↗

Referência

CVE-2018-0824

CVE-2018-0824HIGHsob ataque

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized

100RISCO

abrir ↗

Referência✓ VexDay Proof

GDL 4.x - 'node' SQL Injection

CVE-2009-0965—webappsphp

SQL injection vulnerability in functions/browse.php in Ganesha Digital Library (GDL) 4.0 and 4.2 allows remote attackers

23RISCO

abrir ↗

Referência

CVE-2021-46379

CVE-2021-46379—

DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrust

43RISCO

abrir ↗

Referência

CVE-2021-40449

CVE-2021-40449HIGHsob ataqueransomware

Win32k Elevation of Privilege Vulnerability

100RISCO

abrir ↗

Referência

CVE-2019-7440

CVE-2019-7440—

JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_S

23RISCO

abrir ↗

Referência

CVE-2016-7202

CVE-2016-7202—

The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute a

45RISCO

abrir ↗

Referência

CVE-2016-7202

CVE-2016-7202—

The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute a

45RISCO

abrir ↗

Referência

CVE-2014-7868

CVE-2014-7868—

Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT

45RISCO

abrir ↗

Referência

CVE-2017-1000028

CVE-2017-1000028—

Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Trave

60RISCO

abrir ↗

Referência

CVE-2017-17560

CVE-2017-17560—

An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquer

60RISCO

abrir ↗

Referência

CVE-2019-7440

CVE-2019-7440—

JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_S

23RISCO

abrir ↗

Referência

CVE-2021-46422

CVE-2021-46422—

Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute

60RISCO

abrir ↗

Referência

CVE-2011-0762

CVE-2011-0762—

The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a deni

60RISCO

abrir ↗

Referência

CVE-2011-5007

CVE-2011-5007—

Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB

60RISCO

abrir ↗

Referência

CVE-2014-9618

CVE-2014-9618—

The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote att

60RISCO

abrir ↗

Referência

CVE-2014-9618

CVE-2014-9618—

The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote att

60RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.