Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
79.230exploits catalogados
36.424CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.465Referência 23.022GitHub PoC 15.031VulnCheck XDB 8.860Nuclei 4.361Metasploit 3.491✓ só verificadosrecentespopularesrisco
4.361 exploits
Nucleicritical
Twonky Server 8.5.2 on Linux and Windows - Log File Exposure
Unauthenticated log access in Twonky Server
75RISCO
abrir ↗Nucleihigh
Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read
Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read
36RISCO
abrir ↗Nucleicritical
DynamiApps Frontend Admin <= 3.28.20 - Unauthenticated Arbitrary Options Update
Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
63RISCO
abrir ↗Nucleicritical
NUUO Camera <=20250203 - OS Command Injection
NUUO Camera handle_config.php print_file command injection
60RISCO
abrir ↗Nucleicritical
WP Directory Kit <= 1.4.4 - Authentication Bypass
WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover
63RISCO
abrir ↗Nucleimedium
Responsive Pricing Table <= 5.1.12 - Cross-Site Scripting
Responsive Pricing Table <= 5.1.12 - Authenticated (Author+) Stored Cross-Site Scripting
28RISCO
abrir ↗Nucleicritical
Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
75RISCO
abrir ↗Nucleimedium
Feedback Modal for Website <= 1.0.1 - Unauthenticated Feedback Export
Feedback Modal for Website <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Feedback Data Exfiltration via 'export_data' Parameter
28RISCO
abrir ↗Nucleihigh
IP2Location Country Blocker < 2.38.9 - Unauthenticated Information Disclosure
IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function
36RISCO
abrir ↗Nucleicritical
WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection
CBX Bookmark & Favorite <= 2.0.4 - Authenticated (Subscriber+) SQL Injection via `orderby` Parameter
28RISCO
abrir ↗Nucleicritical
WordPress Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Remote Code Execution
Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Execution
43RISCO
abrir ↗Nucleihigh
Yoco Payments <= 3.8.8 - Path Traversal
Yoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read
36RISCO
abrir ↗Nucleimedium
WP Directory Kit < 1.5.0 - Unauthenticated Email Exposure
WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action
28RISCO
abrir ↗Nucleimedium
LearnPress < 4.3.2 - Broken Access Control
LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure
28RISCO
abrir ↗Nucleimedium
User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion
WP User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
28RISCO
abrir ↗Nucleihigh
Team WordPress Plugin (TLP Team) <= 5.0.9 - SQL Injection
Team < 5.0.11 - Unauthenticated SQLi
36RISCO
abrir ↗Nucleimedium
Premium Addons for Elementor - Unauthenticated Information Disclosure
Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'
28RISCO
abrir ↗Nucleihigh
Payara Server - Cross-Site Scripting
Admin Account Takeover via malicious URL payload
36RISCO
abrir ↗Nucleihigh
WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File
Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File
36RISCO
abrir ↗Nucleihigh
D-Link DIR-803 - Authentication Bypass
D-Link DIR-803 Configuration getcfg.php information disclosure
28RISCO
abrir ↗Nucleicritical
Gladinet CentreStack & Triofox - Hardcoded Credentials
Gladinet CentreStack and TrioFox Hard Coded AES Keys
98RISCO
abrir ↗Nucleimedium
WordPress Widgets for Social Photo Feed <= 1.8 - Information Disclosure
Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints
28RISCO
abrir ↗Nucleicritical
Branda WordPress plugin - Privilege Escalation
Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover
63RISCO
abrir ↗Nucleicritical
RegistrationMagic <= 6.0.7.1 - Privilege Escalation
RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order
43RISCO
abrir ↗Nucleicritical
Sangfor OSM - Arbitrary File Upload
Sangfor Operation and Maintenance Management System common.jsp unrestricted upload
28RISCO
abrir ↗Nucleicritical
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation
63RISCO
abrir ↗Nucleimedium
EasyCVR <=2.1.2 - Information Disclosure
Anhui Xufan Information Technology EasyCVR getbaseconfig information disclosure
28RISCO
abrir ↗Nucleicritical
HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
75RISCO
abrir ↗Nucleicritical
Ingress-Nginx Controller - Remote Code Execution
ingress-nginx admission controller RCE escalation
85RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.