Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
71.836exploits catalogados
32.133CVEs com exploração pública
1.932testados em laboratório
TodosExploit-DB 22.786Referência 19.967GitHub PoC 13.264VulnCheck XDB 8.156Nuclei 4.201Metasploit 3.462✓ só verificadosrecentespopularesrisco
4.201 exploits
Nucleihigh
WordPress WP01 - Path Traversal
WordPress WP01 plugin <= 2.6.2 - Arbitrary File Download Vulnerability
56RISCO
abrir ↗Nucleihigh
SureTriggers – All-in-One Automation Platform ≤ 1.0.78 - Authentication Bypass
SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation
78RISCO
abrir ↗Nucleimedium
Vite Development Server - Path Traversal
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
90RISCO
abrir ↗Nucleihigh
Yeswiki < 4.5.2 - Unauthenticated Path Traversal
Path Traversal allowing arbitrary read of files in Yeswiki
56RISCO
abrir ↗Nucleicritical
CrushFTP - Authentication Bypass
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle
100RISCO
abrir ↗Nucleicritical
SAP NetWeaver Visual Composer Metadata Uploader - Deserialization
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISCO
abrir ↗Nucleimedium
Vite server.fs.deny Bypass - Local File Inclusion
Vite allows server.fs.deny to be bypassed with .svg or relative paths
40RISCO
abrir ↗Nucleihigh
MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads
MinIO performs incomplete signature validation for unsigned-trailer uploads
36RISCO
abrir ↗Nucleimedium
1 Click WordPress Migration <= 2.2 - Unauthenticated Information Disclsoure
WordPress 1 Click WordPress Migration plugin <= 2.5.7 - Sensitive Data Exposure vulnerability
28RISCO
abrir ↗Nucleihigh
Rocket TRUfusion Enterprise - Server Side Request Forgery
Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections. However, the proxy is
36RISCO
abrir ↗Nucleimedium
Vite - Path Traversal
Vite has an `server.fs.deny` bypass with an invalid `request-target`
28RISCO
abrir ↗Nucleicritical
XWiki Platform - SQL Injection
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
85RISCO
abrir ↗Nucleimedium
XWiki Platform - Cross-Site Scripting
XWiki Platform contains Reflected XSS vulnerability in two templates
28RISCO
abrir ↗Nucleicritical
Langflow AI - Unauthenticated Remote Code Execution
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISCO
abrir ↗Nucleihigh
EventON Lite <= 2.4 - Authenticated Local File Inclusion
WordPress EventON plugin <= 2.4 - Local File Inclusion vulnerability
36RISCO
abrir ↗Nucleihigh
SolarWinds Web Help Desk < 12.8.8 Hotfix 1 (HF1) - Security Control Bypass
SolarWinds Web Help Desk Security Control Bypass Vulnerability
100RISCO
abrir ↗Nucleicritical
SolarWinds Web Help Desk < 2026.1 - Unauthenticated JNDI Injection RCE
SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
95RISCO
abrir ↗Nucleicritical
SolarWinds Web Help Desk - Authentication Bypass
SolarWinds Web Help Desk Authentication Bypass Vulnerability
75RISCO
abrir ↗Nucleicritical
SolarWinds Web Help Desk - Authentication Bypass
SolarWinds Web Help Desk Authentication Bypass Vulnerability
75RISCO
abrir ↗Nucleimedium
IceWarp Mail Server ≤11.4.0 - Open Redirect
Open redirection vulnerability in IceWarp Mail Server
28RISCO
abrir ↗Nucleimedium
Wangshen SecGate 3600 Path Traversal Vulnerability
Wangshen SecGate 3600 g=log_export_file path traversal
28RISCO
abrir ↗Nucleihigh
Grafana - XSS / Open Redirect / SSRF via Client Path Traversal
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
78RISCO
abrir ↗Nucleimedium
Spring Framework - Path Traversal
CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers
28RISCO
abrir ↗Nucleicritical
Spring Cloud Gateway Server Webflux - Broken Access Control
Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux
63RISCO
abrir ↗Nucleimedium
Ricoh Web Image Monitor - Reflected XSS
Reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implem
28RISCO
abrir ↗Nucleicritical
RevPi Webstatus <= v2.4.5 - Authentication Bypass
RevPi Webstatus application is vulnerable to an authentication bypass
75RISCO
abrir ↗Nucleihigh
Casdoor - Authorization Bypass
Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization
28RISCO
abrir ↗Nucleimedium
Stop User Enumeration WordPress plugin - Authentication Bypass
Stop User Enumeration < 1.7.3 - Protection Bypass
28RISCO
abrir ↗Nucleicritical
Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
68RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.