Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.620exploits catalogados

35.647CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.455Referência 22.429GitHub PoC 14.270VulnCheck XDB 8.693Nuclei 4.299Metasploit 3.474✓ só verificadosrecentes populares risco

22.429 exploits

Referência

CVE-2021-22555

CVE-2021-22555HIGHsob ataque

Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE

100RISCO

abrir ↗

Referência

CVE-2021-22911

CVE-2021-22911—

A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti

60RISCO

abrir ↗

Referência

CVE-2021-22986

CVE-2021-22986CRITICALsob ataqueransomware

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.

100RISCO

abrir ↗

Referência

CVE-2021-24145

CVE-2021-24145—

Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE

60RISCO

abrir ↗

Referência

CVE-2021-24276

CVE-2021-24276—

Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS)

43RISCO

abrir ↗

Referência

CVE-2021-24286

CVE-2021-24286—

Redirect 404 to Parent < 1.3.1 - Reflected Cross-Site Scripting (XSS)

43RISCO

abrir ↗

Referência

CVE-2021-24499

CVE-2021-24499—

Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

50RISCO

abrir ↗

Referência

CVE-2021-24563

CVE-2021-24563—

Frontend Uploader <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting

28RISCO

abrir ↗

Referência

CVE-2021-24931

CVE-2021-24931—

Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL Injection

60RISCO

abrir ↗

Referência

Tatsu 3.3.11 - Unauthenticated RCE

CVE-2021-25094—webappsphp

Tatsu < 3.3.12 - Unauthenticated RCE

60RISCO

abrir ↗

Referência

CVE-2021-25155

CVE-2021-25155—

A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in v

28RISCO

abrir ↗

Referência

CVE-2021-25158

CVE-2021-25158—

A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s

35RISCO

abrir ↗

Referência

CVE-2021-25159

CVE-2021-25159—

A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in v

28RISCO

abrir ↗

Referência

Local Service Search Engine Management System 1.0 - SQLi Authentication Bypass

CVE-2021-3278—webappsmultiple

Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection

28RISCO

abrir ↗

Referência

CVE-2021-3291

CVE-2021-3291—

Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the mod

28RISCO

abrir ↗

Referência

CASAP Automated Enrollment System 1.0 - 'First Name' Stored XSS

CVE-2021-3294—webappsphp

CASAP Automated Enrollment System 1.0 is affected by cross-site scripting (XSS) in users.php. An attacker can steal a co

23RISCO

abrir ↗

Referência

Postbird 0.8.4 - Javascript Injection

CVE-2021-33570—webappsmultiple

Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can

23RISCO

abrir ↗

Referência

CVE-2021-34369

CVE-2021-34369—

portlets/contact/ref/refContactDetail.do in Accela Civic Platform through 20.1 allows remote attackers to obtain sensiti

23RISCO

abrir ↗

Referência

CVE-2021-35323

CVE-2021-35323—

Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login.

38RISCO

abrir ↗

Referência

CVE-2021-35464

CVE-2021-35464CRITICALsob ataqueransomware

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pa

100RISCO

abrir ↗

Referência

CVE-2021-35464

CVE-2021-35464CRITICALsob ataqueransomware

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pa

100RISCO

abrir ↗

Referência

CVE-2021-3560

CVE-2021-3560HIGHsob ataque

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile

91RISCO

abrir ↗

Referência

CVE-2021-42013

CVE-2021-42013CRITICALsob ataqueransomware

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RISCO

abrir ↗

Referência

CVE-2021-42013

CVE-2021-42013CRITICALsob ataqueransomware

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RISCO

abrir ↗

Referência

CVE-2021-42013

CVE-2021-42013CRITICALsob ataqueransomware

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RISCO

abrir ↗

Referência

CVE-2021-42697

CVE-2021-42697—

Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, whic

35RISCO

abrir ↗

Referência

Ericsson Network Location MPS GMPC21 - Remote Code Execution (RCE) (Metasploit)

CVE-2021-43339—webappsmultiple

In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via file

23RISCO

abrir ↗

Referência

CVE-2021-44228

CVE-2021-44228CRITICALsob ataqueransomware

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

abrir ↗

Referência

CVE-2021-44228

CVE-2021-44228CRITICALsob ataqueransomware

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

abrir ↗

Referência

CVE-2021-44228

CVE-2021-44228CRITICALsob ataqueransomware

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.