Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
79.107exploits catalogados
36.322CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.464Referência 22.936GitHub PoC 15.010VulnCheck XDB 8.846Nuclei 4.361Metasploit 3.490✓ só verificadosrecentespopularesrisco
24.695 exploits
Exploit-DB✓ VexDay Proof
VTLS Virtua InfoStation.cgi - SQL Injection
Multiple SQL injection vulnerabilities in the login in web_reports/cgi-bin/InfoStation.cgi in Innovative vtls-Virtua bef
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Granding MA300 - Traffic Sniffing Man In The Middle Fingerprint PIN Disclosure
Grand MA 300 allows retrieval of the access PIN from sniffed data.
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
ManageEngine Password Manager - MetadataServlet.dat SQL Injection (Metasploit)
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central
50RISCO
abrir ↗Exploit-DB✓ VexDay Proof
ArticleFR - 'id' SQL Injection
Multiple SQL injection vulnerabilities in Free Reprintables ArticleFR 3.0.4 and earlier allow remote attackers to execut
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
ManageEngine Password Manager Pro / ManageEngine IT360 - SQL Injection
SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manag
28RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Gitlab-shell - Code Execution (Metasploit)
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
50RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox - toString console.time Privileged JavaScript Injection (Metasploit)
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbi
28RISCO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin WP Content Source Control - 'download.php' Directory Traversal
Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Sour
43RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Oracle VM VirtualBox 4.3.6 - 3D Acceleration Virtual Machine Escape (Metasploit)
Blue Coat Malware Analysis Appliance (MAA) before 4.2.5 and Malware Analyzer G2 allow remote attackers to bypass a virtu
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Oracle VM VirtualBox 4.3.6 - 3D Acceleration Virtual Machine Escape (Metasploit)
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/s
38RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Oracle VM VirtualBox Guest Additions 4.3.10r93012 - 'VBoxGuest.sys' Local Privilege Escalation (Metasploit)
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.2
38RISCO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin GB Gallery Slideshow - '/wp-admin/admin-ajax.php' SQL Injection
SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administ
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Symantec Endpoint Protection 11.x/12.x - Kernel Pool Overflow / Local Privilege Escalation
Buffer overflow in the sysplant driver in Symantec Endpoint Protection (SEP) Client 11.x and 12.x before 12.1 RU4 MP1b,
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Sphider Search Engine 1.3.6 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in admin/admin.php in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus al
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Sphider Search Engine 1.3.6 - Multiple Vulnerabilities
Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbi
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin WhyDoWork AdSense - 'options-general.php' Cross-Site Request Forgery (Option Manipulation)
Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attacker
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Sphider Search Engine 1.3.6 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to inject arbitrary
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin FB Gorilla - 'game_play.php' SQL Injection
SQL injection vulnerability in game_play.php in the FB Gorilla plugin for WordPress allows remote attackers to execute a
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Lead Octopus Power - 'id' SQL Injection
SQL injection vulnerability in lib/optin/optin_page.php in the Lead Octopus plugin for WordPress allows remote attackers
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Sphider Search Engine 1.3.6 - Multiple Vulnerabilities
SQL injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to execute arbitrary SQL command
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
DirPHP 1.0 - Local File Inclusion
Absolute path traversal vulnerability in DirPHP 1.0 allows remote attackers to read arbitrary files via a full pathname
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows XP SP3 - 'MQAC.sys' Arbitrary Write Privilege Escalation (Metasploit)
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write
43RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Ilya Birman E2 - '/@actions/comment-process' SQL Injection
SQL injection vulnerability in E2 before 2.4 (2845) allows remote attackers to execute arbitrary SQL commands via the no
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Ubiquiti Networks UniFi Video Default - 'crossdomain.xml' Security Bypass
The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVisi
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
IBM GCM16/32 1.20.0.22575 - Multiple Vulnerabilities
systest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote auth
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
IBM GCM16/32 1.20.0.22575 - Multiple Vulnerabilities
prodtest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote aut
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
IBM GCM16/32 1.20.0.22575 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities on IBM GCM16 and GCM32 Global Console Manager switches with firmware
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Omeka 2.2 - Cross-Site Request Forgery / Persistent Cross-Site Scripting
Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the au
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Fonality trixbox - 'repo.php' Directory Traversal
Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a ..
43RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.