Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.230exploits catalogados

36.424CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.465Referência 23.022GitHub PoC 15.031VulnCheck XDB 8.860Nuclei 4.361Metasploit 3.491✓ só verificadosrecentes populares risco

4.361 exploits

Nucleimedium

Mautic <3.3.4 - Cross-Site Scripting

CVE-2021-27909MEDIUM

XSS vulnerability on password reset page

28RISCO

abrir ↗

Nucleicritical

LumisXP <10.0.0 - Blind XML External Entity Attack

CVE-2021-27931—

LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControl

23RISCO

abrir ↗

Nucleicritical

SonLogger - Arbitrary File Upload

CVE-2021-27964—

SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Con

50RISCO

abrir ↗

Nucleimedium

Hongdian H8922 3.0.5 Devices - Local File Inclusion

CVE-2021-28149—

Hongdian H8922 3.0.5 devices allow Directory Traversal. The /log_download.cgi log export handler does not validate user

23RISCO

abrir ↗

Nucleimedium

Hongdian H8922 3.0.5 - Information Disclosure

CVE-2021-28150—

Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the administrator password and oth

18RISCO

abrir ↗

Nucleihigh

Hongdian H8922 3.0.5 - Remote Command Injection

CVE-2021-28151—

Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) f

23RISCO

abrir ↗

Nucleimedium

Eclipse Jetty - Information Disclosure

CVE-2021-28164MEDIUM

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contai

70RISCO

abrir ↗

Nucleimedium

Eclipse Jetty ConcatServlet - Information Disclosure

CVE-2021-28169MEDIUM

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doub

50RISCO

abrir ↗

Nucleimedium

Joomla! ChronoForums 2.0.11 - Local File Inclusion

CVE-2021-28377—

ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files.

18RISCO

abrir ↗

Nucleicritical

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

CVE-2021-28480CRITICAL

Microsoft Exchange Server Remote Code Execution Vulnerability

85RISCO

abrir ↗

Nucleicritical

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

CVE-2021-28481CRITICAL

Microsoft Exchange Server Remote Code Execution Vulnerability

55RISCO

abrir ↗

Nucleicritical

QNAP HBS 3 - Broken Access Control

CVE-2021-28799CRITICALsob ataqueransomware

Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

95RISCO

abrir ↗

Nucleicritical

Netmask NPM Package - Server-Side Request Forgery

CVE-2021-28918—

Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attacke

23RISCO

abrir ↗

Nucleihigh

Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure

CVE-2021-28937—

The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) conta

18RISCO

abrir ↗

Nucleimedium

rConfig 3.9.6 - Local File Inclusion

CVE-2021-29006—

rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any

18RISCO

abrir ↗

Nucleihigh

LDAP Injection In OpenAM

CVE-2021-29156—

ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacke

60RISCO

abrir ↗

Nucleicritical

Apache OFBiz < 17.12.07 - Arbitrary Code Execution

CVE-2021-29200—

RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI

30RISCO

abrir ↗

Nucleicritical

HPE Edgeline Infrastructure Manager <1.22 - Authentication Bypass

CVE-2021-29203—

A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infr

30RISCO

abrir ↗

Nucleicritical

Nacos <1.4.1 - Authentication Bypass

CVE-2021-29441HIGH

Authentication bypass

78RISCO

abrir ↗

Nucleihigh

Nacos <1.4.1 - Authentication Bypass

CVE-2021-29442HIGH

Authentication bypass

68RISCO

abrir ↗

Nucleimedium

Ghost CMS <=4.32 - Cross-Site Scripting

CVE-2021-29484MEDIUM

DOM XSS in Theme Preview

28RISCO

abrir ↗

Nucleimedium

Jellyfin 10.7.2 - Server Side Request Forgery

CVE-2021-29490MEDIUM

Unauthenticated GET requests through Remote Image endpoints

40RISCO

abrir ↗

Nucleihigh

XStream <1.4.17 - Remote Code Execution

CVE-2021-29505HIGH

XStream is vulnerable to a Remote Command Execution attack

58RISCO

abrir ↗

Nucleimedium

Prometheus - Open Redirect

CVE-2021-29622MEDIUM

Arbitrary redirects under /new endpoint

33RISCO

abrir ↗

Nucleimedium

Adminer <=4.8.0 - Cross-Site Scripting

CVE-2021-29625HIGH

XSS in doc_link

36RISCO

abrir ↗

Nucleimedium

Seo Panel 4.8.0 - Cross-Site Scripting

CVE-2021-3002—

Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter.

18RISCO

abrir ↗

Nucleimedium

SysAid Technologies 20.3.64 b14 - Cross-Site Scripting

CVE-2021-30049—

SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI.

18RISCO

abrir ↗

Nucleicritical

Laminas Project laminas-http - Remote Code Execution

CVE-2021-3007—

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead

60RISCO

abrir ↗

Nucleicritical

Kaseya VSA < 9.5.7 - Credential Disclosure via Windows Agent

CVE-2021-30116CRITICALsob ataqueransomware

Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6

95RISCO

abrir ↗

Nucleicritical

Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Execution

CVE-2021-30118CRITICAL

Unauthenticated Remote Code Execution in Kaseya VSA < v9.5.5

55RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.