Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.107exploits catalogados

36.322CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.464Referência 22.936GitHub PoC 15.010VulnCheck XDB 8.846Nuclei 4.361Metasploit 3.490✓ só verificadosrecentes populares risco

4.350 exploits

Nucleimedium

Magento Server MAGMI - Directory Traversal

CVE-2015-2067—

Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento

50RISCO

abrir ↗

Nucleimedium

Magento Server Mass Importer - Cross-Site Scripting

CVE-2015-2068—

Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server a

43RISCO

abrir ↗

Nucleihigh

Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage

CVE-2015-2080—

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive informat

50RISCO

abrir ↗

Nucleimedium

Ericsson Drutt MSDP - Local File Inclusion

CVE-2015-2166—

Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5

43RISCO

abrir ↗

Nucleihigh

WordPress Spider Calendar <=1.4.9 - SQL Injection

CVE-2015-2196—

SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQ

43RISCO

abrir ↗

Nucleimedium

WordPress AB Google Map Travel <=3.4 - Stored Cross-Site Scripting

CVE-2015-2755—

Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for Wo

18RISCO

abrir ↗

Nucleicritical

DotNetNuke 07.04.00 - Administration Authentication Bypass

CVE-2015-2794—

The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain S

50RISCO

abrir ↗

Nucleimedium

Navis DocumentCloud <0.1.1 - Cross-Site Scripting

CVE-2015-2807—

Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress a

18RISCO

abrir ↗

Nucleimedium

Kaseya Virtual System Administrator - Open Redirect

CVE-2015-2863—

Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b

43RISCO

abrir ↗

Nucleihigh

SysAid Help Desk <15.2 - Local File Inclusion

CVE-2015-2996—

Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrar

60RISCO

abrir ↗

Nucleihigh

TP-LINK - Local File Inclusion

CVE-2015-3035HIGHsob ataque

Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before

100RISCO

abrir ↗

Nucleimedium

Ruby on Rails Web Console - Remote Code Execution

CVE-2015-3224—

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-

50RISCO

abrir ↗

Nucleimedium

Elasticsearch - Local File Inclusion

CVE-2015-3337—

Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a

50RISCO

abrir ↗

Nucleihigh

ResourceSpace - Local File inclusion

CVE-2015-3648—

Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before 7.2.6727 allows remote atta

18RISCO

abrir ↗

Nucleimedium

Bonita BPM Portal <6.5.3 - Local File Inclusion

CVE-2015-3897—

Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via

43RISCO

abrir ↗

Nucleimedium

Symfony - Authentication Bypass

CVE-2015-4050—

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.1

18RISCO

abrir ↗

Nucleimedium

WordPress NewStatPress 0.9.8 - SQL Injection

CVE-2015-4062—

SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remo

38RISCO

abrir ↗

Nucleilow

NewStatPress <0.9.9 - Cross-Site Scripting

CVE-2015-4063—

Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPres

38RISCO

abrir ↗

Nucleihigh

Joomla! Helpdesk Pro plugin <1.4.0 - Local File Inclusion

CVE-2015-4074—

Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read ar

43RISCO

abrir ↗

Nucleimedium

WordPress Church Admin <0.810 - Cross-Site Scripting

CVE-2015-4127—

Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers t

38RISCO

abrir ↗

Nucleimedium

WordPress SE HTML5 Album Audio Player 1.1.0 - Directory Traversal

CVE-2015-4414—

Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player)

43RISCO

abrir ↗

Nucleicritical

WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload

CVE-2015-4455—

Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin

43RISCO

abrir ↗

Nucleihigh

Koha 3.20.1 - Directory Traversal

CVE-2015-4632—

Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08

43RISCO

abrir ↗

Nucleimedium

Xceedium Xsuite <=2.4.4.5 - Local File Inclusion

CVE-2015-4666—

Directory traversal vulnerability in opm/read_sessionlog.php in Xceedium Xsuite 2.4.4.5 and earlier allows remote attack

43RISCO

abrir ↗

Nucleimedium

Xsuite <=2.4.4.5 - Open Redirect

CVE-2015-4668—

Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sit

38RISCO

abrir ↗

Nucleihigh

WordPress Zip Attachments <= 1.1.4 - Arbitrary File Retrieval

CVE-2015-4694—

Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote

18RISCO

abrir ↗

Nucleimedium

Novius OS 5.0.1-elche - Open Redirect

CVE-2015-5354—

Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites

43RISCO

abrir ↗

Nucleimedium

WordPress StageShow <5.0.9 - Open Redirect

CVE-2015-5461—

Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for

18RISCO

abrir ↗

Nucleihigh

WordPress MDC YouTube Downloader 2.1.0 - Local File Inclusion

CVE-2015-5469—

Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers t

18RISCO

abrir ↗

Nucleimedium

Swim Team <= v1.44.10777 - Local File Inclusion

CVE-2015-5471—

Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allo

43RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.