Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.401exploits catalogados

35.511CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.451Referência 22.332GitHub PoC 14.209VulnCheck XDB 8.646Nuclei 4.289Metasploit 3.474✓ só verificadosrecentes populares risco

77.401 exploits

GitHub PoC

hello4r1end/patch_CVE-2023-22809

CVE-2023-22809HIGH08 jun 2023

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen

68RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2021-42013CRITICALsob ataqueransomware08 jun 2023

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RISCO

abrir ↗

GitHub PoC★ 56

Cloudpanel 0-day Exploit

CVE-2023-35885CRITICAL08 jun 2023

CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.

85RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2023-35885CRITICAL08 jun 2023

CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.

85RISCO

abrir ↗

GitHub PoC

axelbankole/CVE-2012-1495-Webcalendar-

CVE-2012-1495—08 jun 2023

install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user

60RISCO

abrir ↗

GitHub PoC★ 1

This is a reproduction of PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF) vulnerability

CVE-2021-43617—08 jun 2023

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Val

28RISCO

abrir ↗

Metasploit600

CmsMadeSimple Authenticated File Manager RCE

CVE-2023-36969—07 jun 2023

CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.

30RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2023-23488CRITICAL07 jun 2023

The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerabilit

85RISCO

abrir ↗

GitHub PoC★ 3

SCM Manager XSS

CVE-2023-33829MEDIUM07 jun 2023

A stored cross-site scripting (XSS) vulnerability in Cloudogu GmbH SCM Manager v1.2 to v1.60 allows attackers to execute

33RISCO

abrir ↗

GitHub PoC★ 1

Paid Memberships Pro v2.9.8 (WordPress Plugin) - Unauthenticated SQL Injection

CVE-2023-23488CRITICAL07 jun 2023

The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerabilit

85RISCO

abrir ↗

Metasploit600

VMWare Aria Operations for Networks (vRealize Network Insight) pre-authenticated RCE

CVE-2023-20887CRITICALsob ataque07 jun 2023

Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware

100RISCO

abrir ↗

Metasploit600

Ivanti EPM Agent Portal Command Execution

CVE-2023-28324HIGH07 jun 2023

A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege es

41RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2022-22965CRITICALsob ataque07 jun 2023

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISCO

abrir ↗

GitHub PoC★ 22

CVE-2022-39227 : Proof of Concept

CVE-2022-39227CRITICAL07 jun 2023

Python-jwt subject to Authentication Bypass by Spoofing

48RISCO

abrir ↗

GitHub PoC

Spring rce environment for CVE-2022-22965

CVE-2022-22965CRITICALsob ataque07 jun 2023

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISCO

abrir ↗

GitHub PoC★ 2

CVE-2023-34362-IOCs. More information on Deep Instinct's blog site.

CVE-2023-34362CRITICALsob ataqueransomware06 jun 2023

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.

100RISCO

abrir ↗

GitHub PoC★ 170

CVE-2023-25157 - GeoServer SQL Injection - PoC

CVE-2023-25157CRITICAL06 jun 2023

Unfiltered SQL Injection Vulnerabilities in Geoserver

85RISCO

abrir ↗

VulnCheck XDB

infoleak

CVE-2023-25157CRITICAL06 jun 2023

Unfiltered SQL Injection Vulnerabilities in Geoserver

85RISCO

abrir ↗

GitHub PoC

Python 2.7

CVE-2023-2732CRITICAL06 jun 2023

MStore API <= 3.9.2 - Authentication Bypass

75RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2023-2732CRITICAL06 jun 2023

MStore API <= 3.9.2 - Authentication Bypass

75RISCO

abrir ↗

Exploit-DB

Tree Page View Plugin 1.6.7 - Cross Site Scripting (XSS)

CVE-2023-30868HIGHwebappsphp06 jun 2023

WordPress CMS Tree Page View Plugin <= 1.6.7 is vulnerable to Cross Site Scripting (XSS)

56RISCO

abrir ↗

GitHub PoC

On May 23, 2023 GitLab released version 16.0.1 which fixed a critical vulnerability, CVE-2023-2825, affecting the Community Edition (CE) and Enterprise Edition (EE) version 16.0.0. The vulnerability allows unauthenticated users to read arbitrary files through a path traversal bug.

CVE-2023-2825CRITICAL05 jun 2023

An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a

85RISCO

abrir ↗

GitHub PoC

MrDottt/CVE-2021-22911

CVE-2021-22911—05 jun 2023

A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti

60RISCO

abrir ↗

GitHub PoC

hqdat809/CVE-2021-40444

CVE-2021-40444HIGHsob ataqueransomware05 jun 2023

Microsoft MSHTML Remote Code Execution Vulnerability

100RISCO

abrir ↗

VulnCheck XDB

local

CVE-2021-31956HIGHsob ataque05 jun 2023

Windows NTFS Elevation of Privilege Vulnerability

76RISCO

abrir ↗

VulnCheck XDB

infoleak

CVE-2021-4191MEDIUM05 jun 2023

An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Priv

70RISCO

abrir ↗

GitHub PoC

Proof of concept / CTF script for exploiting CVE-2022-46169 in Cacti, versions >=1.2.22

CVE-2022-46169CRITICALsob ataque05 jun 2023

Unauthenticated Command Injection

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2021-22911—05 jun 2023

A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti

60RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2022-46169CRITICALsob ataque05 jun 2023

Unauthenticated Command Injection

100RISCO

abrir ↗

GitHub PoC

Base64-based encryption oracle exploit for CVE-2017-9248 (Telerik UI for ASP.NET AJAX dialog handler)

CVE-2017-9248CRITICALsob ataque05 jun 2023

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not

100RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.