Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.107exploits catalogados
36.322CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.464Referência 22.936GitHub PoC 15.010VulnCheck XDB 8.846Nuclei 4.361Metasploit 3.490✓ só verificadosrecentespopularesrisco
19.066 exploits
Exploit-DB✓ VexDay Proof
OL-Commerce - '/OL-Commerce/admin/create_account.php?entry_country_id' SQL Injection
CVE-2014-5104—webappsphp17 jul 2014
Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Fonality trixbox - 'index.php' Directory Traversal
CVE-2014-5111—webappsphp17 jul 2014
Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a ..
43RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Fonality trixbox - 'endpoint_generic.php' SQL Injection
CVE-2014-5109—webappsphp17 jul 2014
SQL injection vulnerability in maint/modules/endpointcfg/endpoint_generic.php in Fonality trixbox allows remote attacker
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Omeka 2.2 - Cross-Site Request Forgery / Persistent Cross-Site Scripting
CVE-2014-5100—webappsphp17 jul 2014
Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the au
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
OL-Commerce - '/OL-Commerce/affiliate_show_banner.php?affiliate_banner_id' SQL Injection
CVE-2014-5104—webappsphp17 jul 2014
Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
OL-Commerce - '/OL-Commerce/affiliate_signup.php?a_country' SQL Injection
CVE-2014-5104—webappsphp17 jul 2014
Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Fonality trixbox - 'endpointcfg.php' Directory Traversal
CVE-2014-5111—webappsphp17 jul 2014
Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a ..
43RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
OL-Commerce - '/OL-Commerce/create_account.php?country' SQL Injection
CVE-2014-5104—webappsphp17 jul 2014
Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Fonality trixbox - 'asterisk_info.php' Directory Traversal
CVE-2014-5111—webappsphp17 jul 2014
Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a ..
43RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Alfresco - '/cmisbrowser?url' Server-Side Request Forgery
CVE-2014-9302—remotemultiple16 jul 2014
Server-side request forgery (SSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Servi
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Alfresco - '/proxy?endpoint' Server-Side Request Forgery
CVE-2014-9301—remotemultiple16 jul 2014
Server-side request forgery (SSRF) vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Joomla! Component Youtube Gallery 4.1.7 - SQL Injection
CVE-2014-4960—webappsphp16 jul 2014
Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x throu
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
HP Data Protector Manager 8.10 - Remote Command Execution
CVE-2014-2623—remotewindows14 jul 2014
Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown
60RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Kolibri Web Server 2.0 - GET (SEH)
CVE-2014-4158—remotewindows14 jul 2014
Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a GET req
28RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
D-Link HNAP - Request Remote Buffer Overflow (Metasploit)
CVE-2014-3936—remotehardware14 jul 2014
Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06
60RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin DZS-VideoGallery - Cross-Site Scripting / Command Injection
CVE-2014-9094—webappsphp13 jul 2014
Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Vide
38RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
WeBid - Multiple Cross-Site Scripting / LDAP Injection Vulnerabilities
CVE-2014-5101—webappsphp10 jul 2014
Multiple cross-site scripting (XSS) vulnerabilities in WeBid 1.1.1 allow remote attackers to inject arbitrary web script
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin BSK PDF Manager - '/wp-admin/admin.php' Multiple SQL Injections
CVE-2014-4944—webappsphp09 jul 2014
Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress al
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Dolibarr ERP/CRM 3.5.3 - Multiple Vulnerabilities
CVE-2014-3991—webappsphp08 jul 2014
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Dolibarr ERP/CRM 3.5.3 - Multiple Vulnerabilities
CVE-2014-3992—webappsphp08 jul 2014
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary S
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Gitlist - Remote Command Execution (Metasploit)
CVE-2014-4511—remotemultiple07 jul 2014
Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in
60RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Gitlist - Remote Command Execution (Metasploit)
CVE-2013-7392—remotemultiple07 jul 2014
Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/.
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
AtomCMS - SQL Injection / Arbitrary File Upload
CVE-2014-4852—webappsphp07 jul 2014
SQL injection vulnerability in admin/uploads.php in The Digital Craft AtomCMS, possibly 2.0, allows remote attackers to
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin MailPoet Newsletters 2.6.8 - 'wysija-newsletters' Arbitrary File Upload (Metasploit)
CVE-2014-4725—remotephp07 jul 2014
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authen
50RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
xClassified - 'ads.php' SQL Injection
CVE-2014-4741—webappsphp07 jul 2014
SQL injection vulnerability in demo/ads.php in Artifectx xClassified 1.2 allows remote attackers to execute arbitrary SQ
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Oracle Event Processing FileUploadServlet - Arbitrary File Upload (Metasploit)
CVE-2014-2424—remotewindows07 jul 2014
Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote
50RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Frog CMS 0.9.5 - Arbitrary File Upload
CVE-2014-4912—webappsphp06 jul 2014
An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation.
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Ubisoft Uplay 4.6 - Insecure File Permissions Privilege Escalation
CVE-2014-5453—localwindows03 jul 2014
Ubisoft Uplay PC before 4.6.1.3217 use weak permissions (Everyone: Full Control) for the program installation directory
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 8 - Fixed Col Span ID (Full ASLR + DEP + EMET 4.1.x Bypass) (MS12-037)
CVE-2012-1876—remotewindows01 jul 2014
Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allo
50RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Gitlist 0.4.0 - Remote Code Execution
CVE-2014-5023—remotemultiple30 jun 2014
Repository.php in Gitter, as used in Gitlist, allows remote attackers with commit privileges to execute arbitrary comman
23RISCO
abrir ↗
← anteriorpágina 85 / 636próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.