Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.836exploits catalogados

32.133CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 19.967GitHub PoC 13.264VulnCheck XDB 8.156Nuclei 4.201Metasploit 3.462✓ só verificadosrecentes populares risco

4.201 exploits

Nucleicritical

Lucee Admin - Remote Code Execution

CVE-2021-21307HIGH

Remote Code Exploit in Lucee Admin

78RISCO

abrir ↗

Nucleihigh

Adminer <4.7.9 - Server-Side Request Forgery

CVE-2021-21311HIGHsob ataque

SSRF in adminer

100RISCO

abrir ↗

Nucleihigh

Node.JS System Information Library <5.3.1 - Remote Command Injection

CVE-2021-21315HIGHsob ataque

Command Injection Vulnerability

100RISCO

abrir ↗

Nucleicritical

XStream < 1.4.16 - Remote Code Execution

CVE-2021-21345MEDIUM

XStream is vulnerable to a Remote Command Execution attack

50RISCO

abrir ↗

Nucleicritical

Oracle WebLogic Server - Remote Code Execution

CVE-2021-2135CRITICAL

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Suppor

43RISCO

abrir ↗

Nucleicritical

XStream <1.4.16 - Remote Code Execution

CVE-2021-21351MEDIUM

XStream is vulnerable to an Arbitrary Code Execution attack

50RISCO

abrir ↗

Nucleihigh

BuddyPress REST API <7.2.1 - Privilege Escalation/Remote Code Execution

CVE-2021-21389HIGH

BuddyPress privilege escalation via REST API

61RISCO

abrir ↗

Nucleimedium

Jellyfin <10.7.0 - Local File Inclusion

CVE-2021-21402HIGH

Unauthenticated Arbitrary File Access in Jellyfin

78RISCO

abrir ↗

Nucleicritical

SCIMono <0.0.19 - Remote Code Execution

CVE-2021-21479HIGH

In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availabi

41RISCO

abrir ↗

Nucleimedium

ZTE MF971R - Referer authentication bypass

CVE-2021-21745—

ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use th

30RISCO

abrir ↗

Nucleimedium

Advantech R-SeeNet 2.4.12 - Cross-Site Scripting

CVE-2021-21799CRITICAL

Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (2

48RISCO

abrir ↗

Nucleimedium

Advantech R-SeeNet 2.4.12 - Cross-Site Scripting

CVE-2021-21800CRITICAL

Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.1

48RISCO

abrir ↗

Nucleimedium

Advantech R-SeeNet - Cross-Site Scripting

CVE-2021-21801CRITICAL

This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web application

55RISCO

abrir ↗

Nucleimedium

Advantech R-SeeNet - Cross-Site Scripting

CVE-2021-21802CRITICAL

This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web application

43RISCO

abrir ↗

Nucleicritical

WooCommerce Help Scout - Arbitrary File Upload

CVE-2021-24212—

WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE

18RISCO

abrir ↗

Nucleimedium

GiveWP <= 2.9.7 - Cross-Site Scripting

CVE-2021-24213—

GiveWP < 2.10.0 - Reflected Cross Site Scripting (XSS)

18RISCO

abrir ↗

Nucleimedium

WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting

CVE-2021-24214—

OpenID Connect Generic Client 3.8.0-3.8.1 - Reflected Cross Site Scripting (XSS) via Login Error

18RISCO

abrir ↗

Nucleicritical

Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalation

CVE-2021-24215—

Controlled Admin Access < 1.5.2 - Improper Access Control & Privilege Escalation

18RISCO

abrir ↗

Nucleimedium

All Thrive Themes and Plugins - Unauthenticated Option Update

CVE-2021-24219—

All Thrive Themes and Plugins - Unauthenticated Option Update

18RISCO

abrir ↗

Nucleicritical

Multiple Thrive Themes < 2.0.0 - Arbitrary File Upload

CVE-2021-24220—

All Thrive Themes Legacy Themes < 2.0.0 - Unauthenticated Arbitrary File Upload and Option Deletion

18RISCO

abrir ↗

Nucleihigh

AccessAlly <3.5.7 - Sensitive Information Leakage

CVE-2021-24226—

AccessAlly < 3.5.7 - $_SERVER Superglobal Leakage

18RISCO

abrir ↗

Nucleihigh

Patreon WordPress <1.7.0 - Unauthenticated Local File Inclusion

CVE-2021-24227—

Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure

18RISCO

abrir ↗

Nucleimedium

WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting

CVE-2021-24235—

Goto - Tour & Travel < 2.0 - Unauthenticated Reflected XSS

18RISCO

abrir ↗

Nucleicritical

WordPress Imagements <=1.2.5 - Arbitrary File Upload

CVE-2021-24236—

Imagements <= 1.2.5 - Unauthenticated Arbitrary File Upload to RCE

18RISCO

abrir ↗

Nucleimedium

WordPress Realteo <=1.2.3 - Cross-Site Scripting

CVE-2021-24237—

Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)

18RISCO

abrir ↗

Nucleimedium

WordPress Pie Register <3.7.0.1 - Cross-Site Scripting

CVE-2021-24239—

Pie Register < 3.7.0.1 - Reflected Cross-Site Scripting (XSS)

18RISCO

abrir ↗

Nucleimedium

WordPress Stop Spammers <2021.9 - Cross-Site Scripting

CVE-2021-24245—

Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS)

38RISCO

abrir ↗

Nucleimedium

WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting

CVE-2021-24274—

Ultimate Maps by Supsystic < 1.2.5 - Reflected Cross-Site scripting (XSS)

43RISCO

abrir ↗

Nucleimedium

Popup by Supsystic <1.10.5 - Cross-Site scripting

CVE-2021-24275—

Popup by Supsystic < 1.10.5 - Reflected Cross-Site scripting (XSS)

43RISCO

abrir ↗

Nucleimedium

WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting

CVE-2021-24276—

Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS)

43RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.