Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.230exploits catalogados

36.424CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.465Referência 23.022GitHub PoC 15.031VulnCheck XDB 8.860Nuclei 4.361Metasploit 3.491✓ só verificadosrecentes populares risco

4.361 exploits

Nucleicritical

CraftCMS SEOmatic - Server-Side Template Injection

CVE-2021-41749—

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Si

23RISCO

abrir ↗

Nucleihigh

Apache 2.4.49 - Path Traversal and Remote Code Execution

CVE-2021-41773HIGHsob ataqueransomware

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

abrir ↗

Nucleimedium

PlaceOS 1.2109.1 - Open Redirection

CVE-2021-41826—

PlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessions_controller.rb open redirect.

23RISCO

abrir ↗

Nucleimedium

i-Panel Administration System 2.0 - Cross-Site Scripting

CVE-2021-41878—

A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enable

38RISCO

abrir ↗

Nucleimedium

GitLab GraphQL API User Enumeration

CVE-2021-4191MEDIUM

An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Priv

70RISCO

abrir ↗

Nucleimedium

Resourcespace - Cross-Site Scripting

CVE-2021-41951—

ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_ss

40RISCO

abrir ↗

Nucleicritical

Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution

CVE-2021-42013CRITICALsob ataqueransomware

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RISCO

abrir ↗

Nucleimedium

SAP Knowledge Warehouse <=7.5.0 - Cross-Site Scripting

CVE-2021-42063—

A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage

43RISCO

abrir ↗

Nucleicritical

Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection

CVE-2021-42071—

In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharac

50RISCO

abrir ↗

Nucleihigh

KONGA 0.14.9 - Privilege Escalation

CVE-2021-42192—

Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to pri

23RISCO

abrir ↗

Nucleicritical

Sitecore Experience Platform Pre-Auth RCE

CVE-2021-42237CRITICALsob ataqueransomware

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it

100RISCO

abrir ↗

Nucleicritical

BillQuick Web Suite SQL Injection

CVE-2021-42258CRITICALsob ataqueransomware

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution

95RISCO

abrir ↗

Nucleihigh

WP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Arbitrary Post Deletion

CVE-2021-42359HIGH

WP DSGVO Tools (GDPR) <= 3.1.23 Unauthenticated Arbitrary Post Deletion

36RISCO

abrir ↗

Nucleimedium

NetBiblio WebOPAC - Cross-Site Scripting

CVE-2021-42551MEDIUM

Reflected XSS in NetBiblio WebOPAC search functionality

28RISCO

abrir ↗

Nucleimedium

myfactory FMS - Cross-Site Scripting

CVE-2021-42565—

myfactory.FMS before 7.1-912 allows XSS via the UID parameter.

38RISCO

abrir ↗

Nucleimedium

myfactory FMS - Cross-Site Scripting

CVE-2021-42566—

myfactory.FMS before 7.1-912 allows XSS via the Error parameter.

38RISCO

abrir ↗

Nucleimedium

Apereo CAS Cross-Site Scripting

CVE-2021-42567—

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.

18RISCO

abrir ↗

Nucleicritical

D-Link DIR-615 - Unauthorized Access

CVE-2021-42627—

The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without auth

30RISCO

abrir ↗

Nucleimedium

Sourcecodester Online Event Booking and Reservation System 2.3.0 - Cross-Site Scripting

CVE-2021-42663—

An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via th

18RISCO

abrir ↗

Nucleicritical

Online Event Booking and Reservation System 2.3.0 - SQL Injection

CVE-2021-42667—

A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-manag

23RISCO

abrir ↗

Nucleicritical

TOTOLINK EX1200T 4.1.2cu.5215 - Authentication Bypass

CVE-2021-42887—

In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.

30RISCO

abrir ↗

Nucleimedium

Fortinet FortiMail 7.0.1 - Cross-Site Scripting

CVE-2021-43062MEDIUM

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0

53RISCO

abrir ↗

Nucleihigh

Pre-Auth Takeover of Build Pipelines in GoCD

CVE-2021-43287—

An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default,

43RISCO

abrir ↗

Nucleicritical

Studio-42 elFinder <2.1.60 - Arbitrary File Upload

CVE-2021-43421—

A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remot

30RISCO

abrir ↗

Nucleihigh

AlquistManager Local File Inclusion

CVE-2021-43495—

AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnera

18RISCO

abrir ↗

Nucleihigh

Clustering Local File Inclusion

CVE-2021-43496—

Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vuln

23RISCO

abrir ↗

Nucleicritical

Sourcecodester Simple Client Management System 1.0 - SQL Injection

CVE-2021-43510—

SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the username field in login

18RISCO

abrir ↗

Nucleimedium

Atmail 6.5.0 - Cross-Site Scripting

CVE-2021-43574—

WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default U

18RISCO

abrir ↗

Nucleimedium

Spotweb <= 1.5.1 - Cross Site Scripting (Reflected)

CVE-2021-43725—

There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remot

18RISCO

abrir ↗

Nucleihigh

kkFileview v4.0.0 - Local File Inclusion

CVE-2021-43734—

kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file l

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.