Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
71.836exploits catalogados
32.133CVEs com exploração pública
1.932testados em laboratório
TodosExploit-DB 22.786Referência 19.967GitHub PoC 13.264VulnCheck XDB 8.156Nuclei 4.201Metasploit 3.462✓ só verificadosrecentespopularesrisco
4.201 exploits
Nucleihigh
Discourse OAuth Social Login - Cross-site Scripting
Discourse vulnerable to XSS via user-provided query parameter in oauth failure flow
36RISCO
abrir ↗Nucleicritical
DataEase < 2.10.10 - JWT Authentication Bypass
Dataease Authentication Bypass Vulnerability
41RISCO
abrir ↗Nucleihigh
DataEase - Remote Code Execution
Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability
48RISCO
abrir ↗Nucleihigh
WordPress Custom Login And Signup Widget Plugin <= 1.0 - Arbitrary Code Execution
WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability
63RISCO
abrir ↗Nucleicritical
Roundcube Webmail - Remote Code Execution
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the
100RISCO
abrir ↗Nucleicritical
Pterodactyl Panel - Remote Code Execution
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
68RISCO
abrir ↗Nucleicritical
Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE)
Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.
48RISCO
abrir ↗Nucleicritical
Adobe Experience Manager Forms - Insecure Deserialization
Adobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502)
55RISCO
abrir ↗Nucleicritical
MCP Inspector < 0.14.0 UnauthenticatedRemote Code Execution
MCP Inspector proxy server lacks authentication between the Inspector client and proxy
75RISCO
abrir ↗Nucleimedium
Microsoft SharePoint Server - Authentication Bypass
Microsoft SharePoint Server Spoofing Vulnerability
100RISCO
abrir ↗Nucleicritical
Teleport - Authentication Bypass
Teleport allows remote authentication bypass
43RISCO
abrir ↗Nucleimedium
Heimdall - Host Header Injection & Open Redirect
LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically
43RISCO
abrir ↗Nucleicritical
Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization
Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
95RISCO
abrir ↗Nucleihigh
Letta Letta 0.7.12 - Remote Code Execution
Remote Code Execution in letta.server.rest_api.routers.v1.tools.run_tool_from_source in letta-ai Letta 0.7.12 allows rem
56RISCO
abrir ↗Nucleimedium
Microweber CMS2.0 - Cross-Site Scripting
Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS
28RISCO
abrir ↗Nucleimedium
Microweber CMS 2.0 - Reflected XSS in Admin Page Creation
Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allow
28RISCO
abrir ↗Nucleimedium
PrestaShop - Information Disclosure
An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers
23RISCO
abrir ↗Nucleimedium
XWiki – Stored Cross-Site Scripting (XSS)
XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administra
28RISCO
abrir ↗Nucleicritical
XWiki <= 17.3.0 - Server-Side Template Injection (SSTI)
XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, spe
36RISCO
abrir ↗Nucleicritical
MikoPBX - Unrestricted File Upload
PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbit
43RISCO
abrir ↗Nucleihigh
XWiki - HQL Injection
XWiki Platform vulnerable to HQL injection via wiki and space search REST API
43RISCO
abrir ↗Nucleihigh
DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure
DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input
68RISCO
abrir ↗Nucleicritical
UniFi Access - Broken Access Control
A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access applicat
55RISCO
abrir ↗Nucleicritical
Advantech WISE-IoTSuite/SaaS - SQL Injection
Execution of arbitrary SQL commands
75RISCO
abrir ↗Nucleihigh
Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection
Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection
56RISCO
abrir ↗Nucleicritical
Datart v1.0.0-rc.3 - Remote Code Execution
An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter.
63RISCO
abrir ↗Nucleicritical
HyperComments <= 1.2.2 - Arbitrary Options Update
HyperComments <= 1.2.2 - Unauthenticated (Subscriber+) Arbitrary Options Update
36RISCO
abrir ↗Nucleicritical
Citrix NetScaler Memory Disclosure - CitrixBleed 2
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISCO
abrir ↗Nucleimedium
Commvault Unauthenticated Password Disclosure (WT-2025-0047)
Unauthorized API Access Risk
28RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.