Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.180exploits catalogados

31.691CVEs com exploração pública

0testados em laboratório

Todos Exploit-DB 22.469Referência 19.841GitHub PoC 13.140VulnCheck XDB 8.078Nuclei 4.190Metasploit 3.462✓ só verificadosrecentes populares risco

4.190 exploits

Nucleimedium

Ninja Forms < 3.6.26 - Cross-Site Scripting

CVE-2023-37979HIGH

WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS)

56RISCO

abrir ↗

Nucleimedium

Contact Form Generator <= 2.5.5 - Cross-Site Scripting

CVE-2023-37988HIGH

WordPress Contact Form Generator Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)

36RISCO

abrir ↗

Nucleicritical

HT Mega – Absolute Addons for Elementor <= 2.2.0 - Missing Authorization to Privilege Escalation

CVE-2023-37999CRITICAL

WordPress HT Mega Absolute Addons for Elementor plugin <= 2.2.0 - Unauthenticated Privilege Escalation vulnerability

43RISCO

abrir ↗

Nucleicritical

Ivanti Sentry - Authentication Bypass

CVE-2023-38035CRITICALsob ataqueransomware

A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an

100RISCO

abrir ↗

Nucleimedium

Revive Adserver 5.4.1 - Cross-Site Scripting

CVE-2023-38040—

A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions..

18RISCO

abrir ↗

Nucleimedium

SuperWebMailer 9.00.0.01710 - Cross-Site Scripting

CVE-2023-38192—

An issue was discovered in SuperWebMailer 9.00.0.01710. It allows superadmincreate.php XSS via crafted incorrect passwor

18RISCO

abrir ↗

Nucleimedium

SuperWebMailer - Cross-Site Scripting

CVE-2023-38194—

An issue was discovered in SuperWebMailer 9.00.0.01710. It allows keepalive.php XSS via a GET parameter.

18RISCO

abrir ↗

Nucleicritical

Adobe ColdFusion - Deserialization of Untrusted Data

CVE-2023-38203CRITICALsob ataqueransomware

Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE

95RISCO

abrir ↗

Nucleihigh

Adobe ColdFusion - Access Control Bypass

CVE-2023-38205HIGHsob ataque

ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298

88RISCO

abrir ↗

Nucleicritical

Dahua Smart Park Management - Arbitrary File Upload

CVE-2023-3836MEDIUM

Dahua Smart Park Management unrestricted upload

70RISCO

abrir ↗

Nucleimedium

mooDating 1.2 - Cross-site scripting

CVE-2023-3843LOW

mooSocial mooDating URL question cross site scripting

43RISCO

abrir ↗

Nucleihigh

Fujitsu IP Series - Hardcoded Credentials

CVE-2023-38433—

Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticat

18RISCO

abrir ↗

Nucleimedium

MooDating 1.2 - Cross-Site Scripting

CVE-2023-3844LOW

mooSocial mooDating URL friends cross site scripting

43RISCO

abrir ↗

Nucleimedium

MooDating 1.2 - Cross-Site Scripting

CVE-2023-3845LOW

mooSocial mooDating URL ajax_invite cross site scripting

43RISCO

abrir ↗

Nucleimedium

MooDating 1.2 - Cross-Site Scripting

CVE-2023-3846LOW

mooSocial mooDating URL pages cross site scripting

43RISCO

abrir ↗

Nucleimedium

MooDating 1.2 - Cross-Site scripting

CVE-2023-3847LOW

mooSocial mooDating URL users cross site scripting

43RISCO

abrir ↗

Nucleimedium

MooDating 1.2 - Cross-site scripting

CVE-2023-3848LOW

mooSocial mooDating URL view cross site scripting

43RISCO

abrir ↗

Nucleimedium

mooDating 1.2 - Cross-site scripting

CVE-2023-3849LOW

mooSocial mooDating URL find-a-match cross site scripting

43RISCO

abrir ↗

Nucleimedium

CopyParty v1.8.6 - Cross Site Scripting

CVE-2023-38501MEDIUM

copyparty vulnerable to reflected cross-site scripting via k304 parameter

48RISCO

abrir ↗

Nucleicritical

Metabase < 0.46.6.1 - Remote Code Execution

CVE-2023-38646—

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary comman

60RISCO

abrir ↗

Nucleimedium

PHP Login System 2.0.1 - Cross-Site Scripting

CVE-2023-38875—

A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to ex

18RISCO

abrir ↗

Nucleihigh

openSIS v9.0 - Path Traversal

CVE-2023-38879—

The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a direc

18RISCO

abrir ↗

Nucleihigh

ZKTeco BioTime v8.5.5 - Path Traversal

CVE-2023-38950HIGHsob ataque

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbit

100RISCO

abrir ↗

Nucleihigh

ZKTeco BioTime <= 9.0.1 - Privilege Escalation

CVE-2023-38952HIGH

Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due

36RISCO

abrir ↗

Nucleimedium

Academy LMS 6.0 - Cross-Site Scripting

CVE-2023-38964—

Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability.

18RISCO

abrir ↗

Nucleicritical

Jeecg-Boot v3.5.1 - SQL Injection

CVE-2023-38992—

jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeD

40RISCO

abrir ↗

Nucleimedium

OPNsense - Cross-Site Scripting

CVE-2023-39002—

A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition

18RISCO

abrir ↗

Nucleimedium

PHPJabbers Shuttle Booking Software 1.0 - Cross Site Scripting

CVE-2023-4112MEDIUM

PHP Jabbers Shuttle Booking Software index.php cross site scripting

48RISCO

abrir ↗

Nucleimedium

PHPJabbers Service Booking Script 1.0 - Cross Site Scripting

CVE-2023-4113MEDIUM

PHP Jabbers Service Booking Script index.php cross site scripting

48RISCO

abrir ↗

Nucleimedium

PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting

CVE-2023-4114MEDIUM

PHP Jabbers Night Club Booking Software index.php cross site scripting

48RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.