Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
78.794exploits catalogados
36.057CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.459Referência 22.721GitHub PoC 14.946VulnCheck XDB 8.829Nuclei 4.350Metasploit 3.489✓ só verificadosrecentespopularesrisco
24.695 exploits
Exploit-DB✓ VexDay Proof
Unraid 6.8.0 - Auth Bypass PHP Code Execution (Metasploit)
Unraid through 6.8.0 allows Remote Code Execution.
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Nexus Repository Manager - Java EL Injection RCE (Metasploit)
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Apache Solr - Remote Code Execution via Velocity Template (Metasploit)
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A V
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Arch
68RISCO
abrir ↗Exploit-DB✓ VexDay Proof
VMware Fusion - USB Arbitrator Setuid Privilege Escalation (Metasploit)
VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for
86RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Liferay Portal - Java Unmarshalling via JSONWS RCE (Metasploit)
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)
This vulnerability allows local attackers to escalate privileges on affected installations of TP-Link Archer A7 Firmware
48RISCO
abrir ↗Exploit-DB✓ VexDay Proof
DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit)
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue ex
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit)
DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expect
50RISCO
abrir ↗Exploit-DB✓ VexDay Proof
PlaySMS - index.php Unauthenticated Template Injection Code Execution (Metasploit)
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit)
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expect
50RISCO
abrir ↗Exploit-DB✓ VexDay Proof
DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit)
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code e
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit)
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)
This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer
61RISCO
abrir ↗Exploit-DB✓ VexDay Proof
ThinkPHP - Multiple PHP Injection RCEs (Metasploit)
An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
ThinkPHP - Multiple PHP Injection RCEs (Metasploit)
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public/
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
SharePoint Workflows - XOML Injection (Metasploit)
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.N
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
DLINK DWL-2600 - Authenticated Remote Command Injection (Metasploit)
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Config
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
IBM TM1 / Planning Analytics - Unauthenticated Remote Code Execution (Metasploit)
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated use
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
VMware Fusion 11.5.2 - Privilege Escalation
VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for
86RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Rconfig 3.x - Chained Remote Code Execution (Metasploit)
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Rconfig 3.x - Chained Remote Code Execution (Metasploit)
An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
ManageEngine Desktop Central - Java Deserialization (Metasploit)
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted d
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Nagios XI - Authenticated Remote Command Execution (Metasploit)
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Google Chrome 72 and 73 - Array.map Out-of-Bounds Write (Metasploit)
Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploi
90RISCO
abrir ↗Exploit-DB✓ VexDay Proof
OpenSMTPD - OOB Read Local Privilege Escalation (Metasploit)
OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for mult
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Apache ActiveMQ 5.x-5.11.1 - Directory Traversal Shell Upload (Metasploit)
Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Google Chrome 67_ 68 and 69 - Object.create Type Confusion (Metasploit)
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbit
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Google Chrome 80 - JSCreate Side-effect Type Confusion (Metasploit)
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corru
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
PHP-FPM - Underflow Remote Code Execution (Metasploit)
Underflow in PHP-FPM can lead to RCE
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.