Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.401exploits catalogados

35.511CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.451Referência 22.332GitHub PoC 14.209VulnCheck XDB 8.646Nuclei 4.289Metasploit 3.474✓ só verificadosrecentes populares risco

77.401 exploits

GitHub PoC

On May 23, 2023 GitLab released version 16.0.1 which fixed a critical vulnerability, CVE-2023-2825, affecting the Community Edition (CE) and Enterprise Edition (EE) version 16.0.0. The vulnerability allows unauthenticated users to read arbitrary files through a path traversal bug.

CVE-2023-2825CRITICAL05 jun 2023

An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a

85RISCO

GitHub PoC

Proof of concept / CTF script for exploiting CVE-2022-46169 in Cacti, versions >=1.2.22

CVE-2022-46169CRITICALsob ataque05 jun 2023

Unauthenticated Command Injection

100RISCO

VulnCheck XDB

client-side

CVE-2021-40444HIGHsob ataqueransomware05 jun 2023

Microsoft MSHTML Remote Code Execution Vulnerability

100RISCO

Exploit-DB

File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution (RCE)

CVE-2023-2068—webappsphp04 jun 2023

File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode

50RISCO

VulnCheck XDB

local

CVE-2023-32784HIGH04 jun 2023

In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a work

41RISCO

Exploit-DB

STARFACE 7.3.0.10 - Authentication with Password Hash Possible

CVE-2023-33243HIGHwebappsjsp04 jun 2023

RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the

41RISCO

GitHub PoC

Exploit created in python3 to exploit known vulnerabilities in Apache web server (CVE-2021-41773, CVE-2021-42013)

CVE-2021-41773HIGHsob ataqueransomware03 jun 2023

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

VulnCheck XDB

initial-access

CVE-2021-42013CRITICALsob ataqueransomware03 jun 2023

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RISCO

VulnCheck XDB

initial-access

CVE-2022-22965CRITICALsob ataque03 jun 2023

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISCO

GitHub PoC★ 3

Poc&Exp,支持批量扫描,反弹shell

CVE-2022-22965CRITICALsob ataque03 jun 2023

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISCO

VulnCheck XDB

initial-access

CVE-2021-41773HIGHsob ataqueransomware03 jun 2023

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

GitHub PoC★ 3

CVE-2023-33246：Apache RocketMQ 远程命令执行漏洞检测工具

CVE-2023-33246CRITICALsob ataque02 jun 2023

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

100RISCO

VulnCheck XDB

initial-access

CVE-2022-0441—02 jun 2023

MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation

60RISCO

GitHub PoC★ 1

The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin

CVE-2022-0441—02 jun 2023

MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation

60RISCO

VulnCheck XDB

initial-access

CVE-2023-33246CRITICALsob ataque01 jun 2023

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

100RISCO

Metasploit600

Splunk "edit_user" Capability Privilege Escalation

CVE-2023-32707HIGH01 jun 2023

‘edit_user’ Capability Privilege Escalation

78RISCO

Metasploit600

Chamilo unauthenticated command injection in PowerPoint upload

CVE-2023-34960—01 jun 2023

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to ex

60RISCO

GitHub PoC

[CVE-2021-33690] Server Side Request Forgery vulnerability in SAP NetWeaver Development Infrastructure

CVE-2021-33690CRITICAL01 jun 2023

Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Compo

75RISCO

GitHub PoC★ 81

Apache RocketMQ 远程代码执行漏洞(CVE-2023-33246) Exploit

CVE-2023-33246CRITICALsob ataque01 jun 2023

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

100RISCO

VulnCheck XDB

infoleak

CVE-2021-33690CRITICAL01 jun 2023

Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Compo

75RISCO

GitHub PoC★ 114

Apache RocketMQ 远程代码执行漏洞(CVE-2023-33246) Exploit

CVE-2023-33246CRITICALsob ataque01 jun 2023

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

100RISCO

Exploit-DB

Pydio Cells 4.1.2 - Unauthorised Role Assignments

CVE-2023-32749HIGHwebappsgo31 mai 2023

Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying t

46RISCO

Exploit-DB✓ VexDay Proof

Online Security Guards Hiring System 1.0 - Reflected XSS

CVE-2023-0527LOWwebappsphp31 mai 2023

PHPGurukul Online Security Guards Hiring System search-request.php cross site scripting

43RISCO

Exploit-DB

unilogies/bumsys v1.0.3 beta - Unrestricted File Upload

CVE-2023-0455HIGHwebappsphp31 mai 2023

Unrestricted Upload of File with Dangerous Type in unilogies/bumsys

41RISCO

Exploit-DB

Pydio Cells 4.1.2 - Cross-Site Scripting (XSS) via File Download

CVE-2023-32751MEDIUMwebappsgo31 mai 2023

Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are genera

33RISCO

GitHub PoC★ 2

4mazing/CVE-2023-33246-Copy

CVE-2023-33246CRITICALsob ataque31 mai 2023

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

100RISCO

Exploit-DB

Pydio Cells 4.1.2 - Server-Side Request Forgery

CVE-2023-32750MEDIUMwebappsgo31 mai 2023

Pydio Cells through 4.1.2 allows SSRF. For longer running processes, Pydio Cells allows for the creation of jobs, which

33RISCO

VulnCheck XDB

initial-access

CVE-2022-22965CRITICALsob ataque31 mai 2023

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISCO

GitHub PoC★ 2

A simple python script for a firewall rule that blocks incoming requests based on the Spring4Shell (CVE-2022-22965) vulnerability

CVE-2022-22965CRITICALsob ataque31 mai 2023

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISCO

Metasploit600

Wordpress File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution through shortcode

CVE-2023-2068—31 mai 2023

File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode

50RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.