Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.836exploits catalogados

32.133CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 19.967GitHub PoC 13.264VulnCheck XDB 8.156Nuclei 4.201Metasploit 3.462✓ só verificadosrecentes populares risco

4.201 exploits

Nucleihigh

Intelbras TIP 200/200 LITE/300 - Local File Inclusion

CVE-2020-13886—

Intelbras TIP 200 60.61.75.15, TIP 200 LITE 60.61.75.15, and TIP 300 65.61.75.22 devices allow cgi-bin/cgiServer.exx?pag

18RISCO

abrir ↗

Nucleicritical

Airflow Experimental <1.10.11 - REST API Auth Bypass

CVE-2020-13927CRITICALsob ataque

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but th

100RISCO

abrir ↗

Nucleimedium

Apache Kylin - Exposed Configuration File

CVE-2020-13937—

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.

40RISCO

abrir ↗

Nucleicritical

Apache Unomi <1.5.2 - Remote Code Execution

CVE-2020-13942—

Remote Code Execution in Apache Unomi

50RISCO

abrir ↗

Nucleimedium

Apache APISIX - Insufficiently Protected Credentials

CVE-2020-13945—

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the

40RISCO

abrir ↗

Nucleicritical

WordPress PayPal Pro <1.1.65 - SQL Injection

CVE-2020-14092—

The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.

40RISCO

abrir ↗

Nucleihigh

Gitea 1.1.0 - 1.12.5 - Remote Code Execution

CVE-2020-14144—

The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir

40RISCO

abrir ↗

Nucleimedium

Atlassian Jira Server/Data Center <8.5.8/8.6.0 - 8.11.1 - Information Disclosure

CVE-2020-14179—

Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field

40RISCO

abrir ↗

Nucleimedium

Jira Server and Data Center - Information Disclosure

CVE-2020-14181—

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Infor

60RISCO

abrir ↗

Nucleimedium

Agentejo Cockpit 0.10.2 - Cross-Site Scripting

CVE-2020-14408—

An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login rou

18RISCO

abrir ↗

Nucleimedium

NeDi 1.9C - Cross-Site Scripting

CVE-2020-14413—

NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php. This function at

18RISCO

abrir ↗

Nucleicritical

Oracle WebLogic Server - Remote Command Execution

CVE-2020-14750CRITICALsob ataque

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

100RISCO

abrir ↗

Nucleihigh

Oracle Fusion - Directory Traversal/Local File Inclusion

CVE-2020-14864HIGHsob ataque

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ins

100RISCO

abrir ↗

Nucleicritical

Oracle Weblogic Server - Remote Command Execution

CVE-2020-14882CRITICALsob ataque

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

100RISCO

abrir ↗

Nucleihigh

Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution

CVE-2020-14883HIGHsob ataque

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

100RISCO

abrir ↗

Nucleihigh

Suprema BioStar <2.8.2 - Local File Inclusion

CVE-2020-15050—

An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary fi

50RISCO

abrir ↗

Nucleilow

PrestaShop < 1.7.6.6 - Information Exposure via Upload Directory

CVE-2020-15081MEDIUM

Information exposure in the upload directory in PrestaShop

28RISCO

abrir ↗

Nucleicritical

ThinkCMF X2.2.2 - Remote Code Execution

CVE-2020-20601—

An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet.

18RISCO

abrir ↗

Nucleimedium

GiveWP - Missing Authorization to Settings Update

CVE-2020-20627—

The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauth

18RISCO

abrir ↗

Nucleimedium

Jenkins Gitlab Hook <=1.4.2 - Cross-Site Scripting

CVE-2020-2096—

Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a ref

60RISCO

abrir ↗

Nucleicritical

shadoweb wdja v1.5.1 - Cross-Site Scripting

CVE-2020-20982—

Cross Site Scripting (XSS) vulnerability in shadoweb wdja v1.5.1, allows attackers to execute arbitrary code and gain es

18RISCO

abrir ↗

Nucleimedium

DomainMOD 4.13.0 - Cross-Site Scripting

CVE-2020-20988—

A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attacker

18RISCO

abrir ↗

Nucleimedium

Jenkins <=2.218 - Information Disclosure

CVE-2020-2103—

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI d

18RISCO

abrir ↗

Nucleicritical

Inspur ClusterEngine 4.0 - Remote Code Execution

CVE-2020-21224—

A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0. A remote attacker can send a maliciou

30RISCO

abrir ↗

Nucleimedium

Jenkin Audit Trail <=3.2 - Cross-Site Scripting

CVE-2020-2140—

Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation,

40RISCO

abrir ↗

Nucleimedium

HomeAutomation 3.3.2 - Open Redirect

CVE-2020-21998—

In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified befor

18RISCO

abrir ↗

Nucleihigh

PHPGurukul Hospital Management System 4.0 - SQL Injection

CVE-2020-22165—

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unaut

18RISCO

abrir ↗

Nucleicritical

74cms - ajax_street.php 'x' SQL Injection

CVE-2020-22208—

SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php.

18RISCO

abrir ↗

Nucleicritical

74cms - ajax_common.php SQL Injection

CVE-2020-22209—

SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.

18RISCO

abrir ↗

Nucleicritical

74cms - ajax_officebuilding.php SQL Injection

CVE-2020-22210—

SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.

18RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.