Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.886exploits catalogados

32.153CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 19.978GitHub PoC 13.282VulnCheck XDB 8.176Nuclei 4.202Metasploit 3.462✓ só verificadosrecentes populares risco

4.202 exploits

Nucleimedium

PHPIPAM <v1.5.1 - Missing Authorization

CVE-2023-0678HIGH

Missing Authorization in phpipam/phpipam

48RISCO

abrir ↗

Nucleicritical

modoboa 2.0.4 - Admin TakeOver

CVE-2023-0777HIGH

Authentication Bypass by Primary Weakness in modoboa/modoboa

61RISCO

abrir ↗

Nucleimedium

WordPress Meta SEO <= 4.5.2 - Open Redirect

CVE-2023-0876MEDIUM

WP Meta SEO < 4.5.3 - Subscriber+ Improper Authorization causing Arbitrary Redirect

28RISCO

abrir ↗

Nucleihigh

AP Pricing Tables Lite <= 1.1.6 - SQL Injection

CVE-2023-0900HIGH

AP Pricing Tables Lite <= 1.1.6 - Admin+ SQLi

36RISCO

abrir ↗

Nucleimedium

WordPress Japanized for WooCommerce <2.5.5 - Cross-Site Scripting

CVE-2023-0942MEDIUM

Japanized For WooCommerce <= 2.5.4 - Reflected Cross-Site Scripting

28RISCO

abrir ↗

Nucleicritical

Flatpress < 1.3 - Path Traversal

CVE-2023-0947HIGH

Path Traversal in flatpressblog/flatpress

36RISCO

abrir ↗

Nucleimedium

WordPress Japanized for WooCommerce <2.5.8 - Cross-Site Scripting

CVE-2023-0948MEDIUM

Japanized For WooCommerce < 2.5.8 - Reflected XSS

28RISCO

abrir ↗

Nucleimedium

WordPress Watu Quiz <3.3.9.1 - Cross-Site Scripting

CVE-2023-0968MEDIUM

Watu Quiz <= 3.3.9 - Reflected Cross-Site Scripting

28RISCO

abrir ↗

Nucleicritical

Steveas WP Live Chat Shoutbox <= 1.4.2 - SQL Injection

CVE-2023-1020CRITICAL

Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated SQLi

63RISCO

abrir ↗

Nucleimedium

WordPress GN Publisher <1.5.6 - Cross-Site Scripting

CVE-2023-1080MEDIUM

GN Publisher <= 1.5.5 - Reflected Cross-Site Scripting

28RISCO

abrir ↗

Nucleimedium

WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting

CVE-2023-1119MEDIUM

Multiple Plugins - Cross-Site Scripting From Third-party Library

28RISCO

abrir ↗

Nucleicritical

Mlflow <2.2.1 - Local File Inclusion

CVE-2023-1177CRITICAL

Path Traversal: '\..\filename' in mlflow/mlflow

75RISCO

abrir ↗

Nucleimedium

Coming Soon & Maintenance < 4.1.7 - Unauthenticated Post/Page Access

CVE-2023-1263MEDIUM

CMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.6 - Information Exposure

28RISCO

abrir ↗

Nucleimedium

osTicket < v1.16.6 - Cross-Site Scripting

CVE-2023-1315MEDIUM

Cross-site Scripting (XSS) - Reflected in osticket/osticket

28RISCO

abrir ↗

Nucleimedium

osTicket < v1.16.6 - Cross-Site Scripting

CVE-2023-1317MEDIUM

Cross-site Scripting (XSS) - Reflected in osticket/osticket

28RISCO

abrir ↗

Nucleimedium

osTicket < v1.16.6 - Cross-Site Scripting

CVE-2023-1318MEDIUM

Cross-site Scripting (XSS) - Generic in osticket/osticket

28RISCO

abrir ↗

Nucleimedium

unilogies/bumsys < v2.0.2 - Clickjacking

CVE-2023-1362HIGH

Improper Restriction of Rendered UI Layers or Frames in unilogies/bumsys

36RISCO

abrir ↗

Nucleicritical

TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection

CVE-2023-1389HIGHsob ataque

TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability i

100RISCO

abrir ↗

Nucleihigh

Video List Manager <= 1.7 - SQL Injection

CVE-2023-1408HIGH

Video List Manager <= 1.7 - Admin+ SQL Injection

36RISCO

abrir ↗

Nucleicritical

Jeecg-boot 3.5.0 qurestSql - SQL Injection

CVE-2023-1454MEDIUM

jeecg-boot qurestSql sql injection

60RISCO

abrir ↗

Nucleimedium

Imgproxy < 3.14.0 - Cross-site Scripting (XSS)

CVE-2023-1496MEDIUM

Cross-site Scripting (XSS) - Reflected in imgproxy/imgproxy

28RISCO

abrir ↗

Nucleimedium

MyCryptoCheckout < 2.124 - Cross-Site Scripting

CVE-2023-1546MEDIUM

MyCryptoCheckout < 2.124 - Reflected XSS

28RISCO

abrir ↗

Nucleicritical

Sophos Web Appliance - Remote Code Execution

CVE-2023-1671CRITICALsob ataque

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10

100RISCO

abrir ↗

Nucleicritical

WAGO - Remote Command Execution

CVE-2023-1698CRITICAL

WAGO: WBM Command Injection in multiple products

85RISCO

abrir ↗

Nucleicritical

Bitrix Component - Cross-Site Scripting

CVE-2023-1719HIGH

Bitrix24 Insecure Global Variable Extraction

36RISCO

abrir ↗

Nucleicritical

SupportCandy < 3.1.5 - Unauthenticated SQL Injection

CVE-2023-1730CRITICAL

SupportCandy < 3.1.5 - Unauthenticated SQLi

75RISCO

abrir ↗

Nucleimedium

Companion Sitemap Generator < 4.5.3 - Cross-Site Scripting

CVE-2023-1780—

Companion Sitemap Generator < 4.5.3 - Reflected XSS

18RISCO

abrir ↗

Nucleimedium

Ninja Forms < 3.6.22 - Cross-Site Scripting

CVE-2023-1835MEDIUM

Ninja Forms < 3.6.22 - Reflected XSS

28RISCO

abrir ↗

Nucleimedium

Phpmyfaq v3.1.11 - Cross-Site Scripting

CVE-2023-1880HIGH

Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

36RISCO

abrir ↗

Nucleimedium

Tablesome < 1.0.9 - Cross-Site Scripting

CVE-2023-1890MEDIUM

Tablesome < 1.0.9 - Reflected XSS

28RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.