Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.814exploits catalogados

32.125CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 19.967GitHub PoC 13.248VulnCheck XDB 8.150Nuclei 4.201Metasploit 3.462✓ só verificadosrecentes populares risco

4.193 exploits

Nucleimedium

mooSocial 3.1.6 - Reflected Cross Site Scripting

CVE-2023-4174LOW

mooSocial mooStore cross site scripting

43RISCO

abrir ↗

Nucleimedium

Skype for Business 2019 (SfB) - Blind Server-side Request Forgery

CVE-2023-41763MEDIUMsob ataque

Skype for Business Elevation of Privilege Vulnerability

80RISCO

abrir ↗

Nucleicritical

CraftCMS < 4.4.15 - Unauthenticated Remote Code Execution

CVE-2023-41892CRITICAL

Craft CMS Remote Code Execution vulnerability

85RISCO

abrir ↗

Nucleihigh

ProfilePress <= 4.13.1 — Unauthenticated Privilege Escalation

CVE-2023-41954HIGH

WordPress ProfilePress plugin <= 4.13.1 - Unauthenticated Limited Privilege Escalation vulnerability

36RISCO

abrir ↗

Nucleimedium

Chamilo LMS <= 1.11.24 - Remote Code Execution

CVE-2023-4220HIGH

Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

78RISCO

abrir ↗

Nucleimedium

OpenCMS - Cross-Site Scripting

CVE-2023-42343MEDIUM

A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.

28RISCO

abrir ↗

Nucleihigh

OpenCMS - XML external entity (XXE)

CVE-2023-42344HIGH

Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/

56RISCO

abrir ↗

Nucleimedium

JumpServer > 3.6.4 - Information Disclosure

CVE-2023-42442HIGH

JumpServer session replays download without authentication

48RISCO

abrir ↗

Nucleicritical

JetBrains TeamCity < 2023.05.4 - Remote Code Execution

CVE-2023-42793CRITICALsob ataqueransomware

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

100RISCO

abrir ↗

Nucleihigh

WordPress Post Timeline Plugin < 2.2.6 - Cross-Site Scripting

CVE-2023-4284—

Post Timeline < 2.2.6 - Reflected XSS

18RISCO

abrir ↗

Nucleicritical

CrushFTP < 10.5.1 - Unauthenticated Remote Code Execution

CVE-2023-43177—

CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes

60RISCO

abrir ↗

Nucleicritical

NodeBB XML-RPC Request xmlrpc.php - XML Injection

CVE-2023-43187—

A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.1

30RISCO

abrir ↗

Nucleicritical

NextGen Healthcare Mirth Connect - Remote Code Execution

CVE-2023-43208CRITICALsob ataqueransomware

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that

100RISCO

abrir ↗

Nucleihigh

Milesight Routers - Information Disclosure

CVE-2023-43261HIGH

An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensiti

68RISCO

abrir ↗

Nucleimedium

mooSocial 3.1.8 - External Service Interaction

CVE-2023-43323—

mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP a

18RISCO

abrir ↗

Nucleimedium

MooSocial 3.1.8 - Cross-Site Scripting

CVE-2023-43325—

A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows atta

18RISCO

abrir ↗

Nucleimedium

MooSocial 3.1.8 - Cross-Site Scripting

CVE-2023-43326—

A reflected cross-site scripting (XSS) vulnerability exisits in multiple url of mooSocial v3.1.8 allows attackers to ste

18RISCO

abrir ↗

Nucleicritical

Hoteldruid v3.0.5 - SQL Injection

CVE-2023-43373CRITICAL

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n_utente_agg parameter at /hoteldruid/

43RISCO

abrir ↗

Nucleicritical

Hoteldruid v3.0.5 - SQL Injection

CVE-2023-43374CRITICAL

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid

43RISCO

abrir ↗

Nucleihigh

MLFlow < 2.8.1 - Sensitive Information Disclosure

CVE-2023-43472—

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted requ

30RISCO

abrir ↗

Nucleicritical

PyTorch TorchServe SSRF

CVE-2023-43654CRITICAL

TorchServe Server-Side Request Forgery

75RISCO

abrir ↗

Nucleicritical

Apache OFBiz < 18.12.11 - Remote Code Execution

CVE-2023-51467—

Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability

60RISCO

abrir ↗

Nucleicritical

WP Sessions Time Monitoring Full Automatic <= 1.0.8 - SQL Injection

CVE-2023-5203HIGH

WP Sessions Time Monitoring Full Automatic < 1.0.9 - Unauthenticated SQL injection

36RISCO

abrir ↗

Nucleicritical

WordPress AI ChatBot (WPBot) <= 4.8.9 - SQL Injection

CVE-2023-5204CRITICAL

AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response

63RISCO

abrir ↗

Nucleimedium

Winter CMS Local File Inclusion - (LFI)

CVE-2023-52085LOW

Winter CMS Local File Inclusion through Server Side Template Injection

35RISCO

abrir ↗

Nucleihigh

Digiever DS-2105 Pro - Command Injection

CVE-2023-52163HIGHsob ataque

Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects

88RISCO

abrir ↗

Nucleicritical

Viessmann Vitogate 300 - Hardcoded Password

CVE-2023-5222MEDIUM

Viessmann Vitogate 300 Web Management Interface vitogate.cgi isValidUser hard-coded password

70RISCO

abrir ↗

Nucleihigh

Kafka UI 0.7.1 Command Injection

CVE-2023-52251HIGH

An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the

78RISCO

abrir ↗

Nucleimedium

Microweber < V.2.0 - Cross-Site Scripting

CVE-2023-5244MEDIUM

Cross-site Scripting (XSS) - Reflected in microweber/microweber

28RISCO

abrir ↗

Nucleicritical

WordPress Royal Elementor Addons Plugin <= 1.3.78 - Arbitrary File Upload

CVE-2023-5360—

Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload

60RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.