Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
71.836exploits catalogados
32.133CVEs com exploração pública
1.932testados em laboratório
TodosExploit-DB 22.786Referência 19.967GitHub PoC 13.264VulnCheck XDB 8.156Nuclei 4.201Metasploit 3.462✓ só verificadosrecentespopularesrisco
4.201 exploits
Nucleicritical
RestroPress 3.0.0-3.2.1 - Authentication Bypass
RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT
63RISCO
abrir ↗Nucleimedium
N-central - Authentication Bypass
N-central unauthenticated sessionID generation
60RISCO
abrir ↗Nucleicritical
Loan Management System 1.0 - SQL Injection
Campcodes Online Loan Management System ajax.php sql injection
28RISCO
abrir ↗Nucleimedium
The Events Calendar <= 6.15.2 - Information Disclosure
The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure
28RISCO
abrir ↗Nucleimedium
Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File
Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File
33RISCO
abrir ↗Nucleicritical
MLflow Job API - Authentication Bypass
Missing Authentication for Critical Function in mlflow/mlflow
36RISCO
abrir ↗Nucleihigh
LolLMS < 2.2.0 - Server-Side Request Forgery
Server-Side Request Forgery (SSRF) in parisneo/lollms
36RISCO
abrir ↗Nucleimedium
WordPress List Site Contributors < 1.1.8 - Reflected XSS
List Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alpha
28RISCO
abrir ↗Nucleicritical
Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
75RISCO
abrir ↗Nucleicritical
Langflow < 1.3.0 - Remote Code Execution via validate_code() exec()
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
98RISCO
abrir ↗Nucleihigh
Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending
Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending
28RISCO
abrir ↗Nucleicritical
Prodigy Commerce <= 3.3.0 - Local File Inclusion
Prodigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]
63RISCO
abrir ↗Nucleicritical
Ivanti Sentry - OS Command Injection
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote
85RISCO
abrir ↗Nucleicritical
Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover
Hippoo Mobile App for WooCommerce <= 1.9.4 - Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API
63RISCO
abrir ↗Nucleihigh
YMC Filter WordPress - Unauthenticated Post Disclosure
YMC Smart Filter < 3.11.3 - Unauthenticated Private/Draft Post Disclosure
56RISCO
abrir ↗Nucleihigh
Django RasterField - SQL Injection
Potential SQL injection via raster lookups on PostGIS
28RISCO
abrir ↗Nucleimedium
URL Shortify <= 1.12.1 - Open Redirect
URL Shortify <= 1.12.1 - Unauthenticated Open Redirect via 'redirect_to' Parameter
28RISCO
abrir ↗Nucleimedium
Frontend Post Submission Manager Lite <= 1.2.7 - Open Redirect
Frontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameter
28RISCO
abrir ↗Nucleicritical
WordPress midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload
midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX Action
43RISCO
abrir ↗Nucleimedium
WordPress 3D FlipBook <= 1.16.17 - Information Disclosure
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.17 - Missing Authorization to Unauthenticated Private/Draft Flipbook Data Exposure
28RISCO
abrir ↗Nucleicritical
WPvivid Backup & Migration <= 0.9.123 - Arbitrary File Upload
Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
75RISCO
abrir ↗Nucleihigh
Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation
Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation
36RISCO
abrir ↗Nucleihigh
WPBot <= 8.4.9 - Cross-Site Scripting
WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
36RISCO
abrir ↗Nucleicritical
WordPress Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload
Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload
63RISCO
abrir ↗Nucleicritical
WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation
User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration
68RISCO
abrir ↗Nucleimedium
WP Hotel Booking <= 2.3.2 - Cross-Site Scripting
WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter
28RISCO
abrir ↗Nucleihigh
WP Responsive Images <= 1.0 - Arbitrary File Read
WP Responsive Images <= 1.0 - Unauthenticated Path Traversal to Arbitrary File Read via src
36RISCO
abrir ↗Nucleicritical
wpForo Forum <= 2.4.14 - SQL Injection
wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection
56RISCO
abrir ↗Nucleihigh
Ivanti Endpoint Manager - Authentication Bypass
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to
88RISCO
abrir ↗Nucleimedium
LeadConnector < 3.0.22 - Unauthenticated Arbitrary Data Write
LeadConnector < 3.0.22 - Unauthenticated Rest Call
28RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.