Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.760exploits catalogados
32.083CVEs com exploração pública
1.932testados em laboratório
TodosExploit-DB 22.786Referência 19.934GitHub PoC 13.235VulnCheck XDB 8.150Nuclei 4.193Metasploit 3.462✓ só verificadosrecentespopularesrisco
4.193 exploits
Nucleihigh
Ruijie RG-EW1200G Router Background - Login Bypass
CVE-2023-4415HIGH
Ruijie RG-EW1200G login improper authentication
48RISCO
abrir ↗
Nucleimedium
Adobe Coldfusion - Cross-Site Scripting
CVE-2023-44352MEDIUM
Unauthenticate Reflected XSS on Adobe Coldfusion 2018 - 2021 - 2023 last version
50RISCO
abrir ↗
Nucleicritical
Adobe ColdFusion WDDX Deserialization Gadgets
CVE-2023-44353CRITICAL
ColdFusion WDDX Deserialization Gadgets
65RISCO
abrir ↗
Nucleimedium
Piwigo - Cross-Site Scripting
CVE-2023-44393CRITICAL
Piwigo Reflected XSS vulnerability
43RISCO
abrir ↗
Nucleicritical
JeecgBoot JimuReport - Template injection
CVE-2023-4450MEDIUM
jeecgboot JimuReport Template injection
53RISCO
abrir ↗
Nucleimedium
Cockpit - Cross-Site Scripting
CVE-2023-4451MEDIUM
Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit
28RISCO
abrir ↗
Nucleimedium
mooSocial v.3.1.8 - Cross-Site Scripting
CVE-2023-44812—
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a c
18RISCO
abrir ↗
Nucleimedium
mooSocial v.3.1.8 - Cross-Site Scripting
CVE-2023-44813—
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a c
18RISCO
abrir ↗
Nucleihigh
WordPress Job Portal < 2.0.6 - SQL Injection
CVE-2023-4490CRITICAL
WP Job Portal < 2.0.6 - Unauthenticated SQLi
63RISCO
abrir ↗
Nucleimedium
WordPress Perfect Images (WP Retina 2x) < 6.4.6 - Sensitive Information Exposure
CVE-2023-44982MEDIUM
WordPress WP Retina 2x Plugin <= 6.4.5 is vulnerable to Sensitive Data Exposure
28RISCO
abrir ↗
Nucleimedium
QNAP Music Station < 5.4.0 - Authentication Bypass
CVE-2023-45038MEDIUM
Music Station
28RISCO
abrir ↗
Nucleimedium
XWiki < 14.10.14 - Cross-Site Scripting
CVE-2023-45136CRITICAL
XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled
43RISCO
abrir ↗
Nucleicritical
Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE
CVE-2023-4521CRITICAL
Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE
75RISCO
abrir ↗
Nucleihigh
PrestaShop PireosPay - SQL Injection
CVE-2023-45375—
In the module "PireosPay" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL
30RISCO
abrir ↗
Nucleicritical
D-Link DAR-8000-10 - Command Injection
CVE-2023-4542MEDIUM
D-Link DAR-8000-10 sys1.php os command injection
70RISCO
abrir ↗
Nucleimedium
SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting
CVE-2023-4547LOW
SPA-Cart eCommerce CMS search cross site scripting
55RISCO
abrir ↗
Nucleimedium
MooSocial 3.1.8 - Cross-Site Scripting
CVE-2023-45542—
Cross Site Scripting vulnerability in mooSocial 3.1.8 allows a remote attacker to obtain sensitive information via a cra
18RISCO
abrir ↗
Nucleimedium
Apache Tomcat - HTTP Request Smuggling
CVE-2023-45648MEDIUM
Apache Tomcat: Trailer header parsing too lenient
28RISCO
abrir ↗
Nucleimedium
Frigate < 0.13.0 Beta 3 - Cross-Site Scripting
CVE-2023-45671MEDIUM
Frigate reflected XSS through `/<camera_name>` API endpoints
28RISCO
abrir ↗
Nucleimedium
PaperCut NG Unauthenticated XMLRPC Functionality
CVE-2023-4568MEDIUM
PaperCut NG Unauthenticated XMLRPC
28RISCO
abrir ↗
Nucleimedium
Leantime < 2.4 - Authenticated SQL Injection
CVE-2023-45826MEDIUM
Authenticated SQL Injection in leantime
28RISCO
abrir ↗
Nucleicritical
Viessmann Vitogate 300 - Remote Code Execution
CVE-2023-45852—
In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute a
23RISCO
abrir ↗
Nucleihigh
qdPM 9.2 - Directory Traversal
CVE-2023-45855—
qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.
18RISCO
abrir ↗
Nucleicritical
Gibbon LMS <= v25.0.01 - File Upload to RCE
CVE-2023-45878—
GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not
50RISCO
abrir ↗
Nucleicritical
WordPress Plugin Forminator 1.24.6 - Arbitrary File Upload
CVE-2023-4596CRITICAL
Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload
68RISCO
abrir ↗
Nucleicritical
Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion
CVE-2023-4634CRITICAL
Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution
85RISCO
abrir ↗
Nucleicritical
PrestaShop Step by Step products Pack - SQL Injection
CVE-2023-46347CRITICAL
In the module "Step by Step products Pack" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a
55RISCO
abrir ↗
Nucleicritical
cPH2 Charging Station v1.87.0 - OS Command Injection
CVE-2023-46359CRITICAL
An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthen
65RISCO
abrir ↗
Nucleihigh
GL.iNet <= 4.3.7 - Arbitrary File Write
CVE-2023-46455—
In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attac
30RISCO
abrir ↗
Nucleicritical
TOTOLINK A3700R - Command Injection
CVE-2023-46574—
An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName p
30RISCO
abrir ↗
← anteriorpágina 71 / 140próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.