Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.107exploits catalogados

36.322CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.464Referência 22.936GitHub PoC 15.010VulnCheck XDB 8.846Nuclei 4.361Metasploit 3.490✓ só verificadosrecentes populares risco

79.107 exploits

VulnCheck XDB

local

CVE-2020-0041HIGHsob ataque31 mar 2020

In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could

71RISCO

Metasploit600

Nexus Repository Manager Java EL Injection RCE

CVE-2020-10199HIGHsob ataque31 mar 2020

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

100RISCO

Metasploit300

Grandstream UCM62xx IP PBX WebSocket Blind SQL Injection Credential Dump

CVE-2020-5723—30 mar 2020

The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an atta

18RISCO

Metasploit300

Grandstream UCM62xx IP PBX WebSocket Blind SQL Injection Credential Dump

CVE-2020-5724—30 mar 2020

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpo

23RISCO

GitHub PoC★ 14

CVE-2020-8515-PoC

CVE-2020-8515CRITICALsob ataque30 mar 2020

DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow

100RISCO

GitHub PoC

Exploit for the CVE-2019-16278 vulnerability

CVE-2019-16278CRITICALsob ataque30 mar 2020

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co

100RISCO

Exploit-DB

Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Local Privilege Escalation

CVE-2020-0796CRITICALsob ataqueransomwarelocalwindows30 mar 2020

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

100RISCO

GitHub PoC

tripledd/cve-2020-0796-vuln

CVE-2020-0796CRITICALsob ataqueransomware30 mar 2020

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

100RISCO

GitHub PoC★ 1.359

CVE-2020-0796 - Windows SMBv3 LPE exploit #SMBGhost

CVE-2020-0796CRITICALsob ataqueransomware30 mar 2020

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

100RISCO

VulnCheck XDB

local

CVE-2020-0796CRITICALsob ataqueransomware30 mar 2020

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

100RISCO

GitHub PoC★ 244

CVE-2020-0796 Local Privilege Escalation POC

CVE-2020-0796CRITICALsob ataqueransomware30 mar 2020

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

100RISCO

Exploit-DB

Multiple DrayTek Products - Pre-authentication Remote Root Code Execution

CVE-2020-8515CRITICALsob ataqueremotelinux30 mar 2020

DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow

100RISCO

VulnCheck XDB

initial-access

CVE-2019-16278CRITICALsob ataque30 mar 2020

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co

100RISCO

VulnCheck XDB

initial-access

CVE-2020-8515CRITICALsob ataque30 mar 2020

DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow

100RISCO

VulnCheck XDB

initial-access

CVE-2020-7961CRITICALsob ataque29 mar 2020

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c

100RISCO

VulnCheck XDB

denial-of-service

CVE-2018-8639HIGHsob ataqueransomware28 mar 2020

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

76RISCO

VulnCheck XDB

client-side

CVE-2019-5786MEDIUMsob ataque28 mar 2020

Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform

90RISCO

Metasploit400

Pi-Hole DHCP MAC OS Command Execution

CVE-2020-8816CRITICALsob ataque28 mar 2020

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static l

100RISCO

GitHub PoC★ 7

Icecast Header Overwrite buffer overflow RCE < 2.0.1 (Win32)

CVE-2004-1561—27 mar 2020

Buffer overflow in Icecast 2.0.1 and earlier allows remote attackers to execute arbitrary code via an HTTP request with

60RISCO

GitHub PoC★ 8

CVE-2020-1938 / CNVD-2020-1048 Detection Tools

CVE-2020-1938CRITICALsob ataque27 mar 2020

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc

100RISCO

VulnCheck XDB

infoleak

CVE-2020-1938CRITICALsob ataque27 mar 2020

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc

100RISCO

GitHub PoC★ 1

CVE-2019-17558 Solr模板注入漏洞图形化一键检测工具。CVE-2019-17558 Solr Velocity Template Vul POC Tool.

CVE-2019-17558HIGHsob ataque27 mar 2020

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A V

100RISCO

GitHub PoC★ 1

CVE 2018-16763

CVE-2018-16763—26 mar 2020

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca

60RISCO

Metasploit600

GitLab File Read Remote Code Execution

CVE-2020-10977—26 mar 2020

GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.

30RISCO

Exploit-DB

TP-Link Archer C50 3 - Denial of Service (PoC)

CVE-2020-9375—doshardware26 mar 2020

TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a

28RISCO

GitHub PoC★ 118

mzer0one/CVE-2020-7961-POC

CVE-2020-7961CRITICALsob ataque26 mar 2020

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c

100RISCO

VulnCheck XDB

initial-access

CVE-2018-16763—26 mar 2020

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca

60RISCO

VulnCheck XDB

initial-access

CVE-2020-7961CRITICALsob ataque26 mar 2020

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c

100RISCO

Exploit-DB

LeptonCMS 4.5.0 - Persistent Cross-Site Scripting

CVE-2020-12707—webappsphp25 mar 2020

An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only secur

23RISCO

GitHub PoC★ 20

TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a crafted HTTP Header containing an unexpected Referer field.

CVE-2020-9375—25 mar 2020

TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a

28RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.