Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.886exploits catalogados
32.153CVEs com exploração pública
1.932testados em laboratório
TodosExploit-DB 22.786Referência 19.978GitHub PoC 13.282VulnCheck XDB 8.176Nuclei 4.202Metasploit 3.462✓ só verificadosrecentespopularesrisco
4.202 exploits
Nucleimedium
TP-Link Archer A20 v3 Router - Cross-site Scripting
CVE-2024-57514MEDIUM
The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting (XSS) due to improper handling of directory listi
28RISCO
abrir ↗
Nucleihigh
WpStickyBar <= 2.1.0 - SQL Injection
CVE-2024-5765CRITICAL
WpStickyBar <= 2.1.0 - Unauthenticated SQLi
68RISCO
abrir ↗
Nucleihigh
SimpleHelp <= 5.5.7 - Unauthenticated Path Traversal
CVE-2024-57727CRITICALsob ataqueransomware
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enabl
100RISCO
abrir ↗
Nucleicritical
Yii2 PHP Framework < 2.0.52 - Remote Code Execution
CVE-2024-58136CRITICALsob ataque
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regres
95RISCO
abrir ↗
Nucleicritical
Vanna - SQL injection
CVE-2024-5827CRITICAL
Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna
43RISCO
abrir ↗
Nucleicritical
Palo Alto Expedition - Admin Account Takeover
CVE-2024-5910CRITICALsob ataque
Expedition: Missing Authentication Leads to Admin Account Takeover
100RISCO
abrir ↗
Nucleicritical
GiveWP - PHP Object Injection
CVE-2024-5932CRITICAL
GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution
85RISCO
abrir ↗
Nucleimedium
PrivateGPT < 0.5.0 - Open Redirect
CVE-2024-5936MEDIUM
Open Redirect in imartinez/privategpt
33RISCO
abrir ↗
Nucleimedium
Deep Sea Electronics DSE855 - Authentication Bypass
CVE-2024-5947MEDIUM
Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability
28RISCO
abrir ↗
Nucleicritical
CZ Loan Management <= 1.1 - SQL Injection
CVE-2024-5975CRITICAL
CZ Loan Management <= 1.1 - Unauthenticated SQLi
43RISCO
abrir ↗
Nucleicritical
Quiz Maker <= 6.5.8.3 - SQL Injection
CVE-2024-6028CRITICAL
Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter
68RISCO
abrir ↗
Nucleihigh
Lawo AG vsm LTC Time Sync (vTimeSync) - Path Traversal
CVE-2024-6049HIGH
Unauthenticated Path Traversal
36RISCO
abrir ↗
Nucleimedium
LocalAI - Partial Local File Read
CVE-2024-6095MEDIUM
SSRF and Partial LFI in /models/apply Endpoint in mudler/localai
28RISCO
abrir ↗
Nucleicritical
Push Notification for Post and BuddyPress <= 1.93 - SQL Injection
CVE-2024-6159CRITICAL
Push Notification for Post and BuddyPress <=1.93 - Multiple Unauthenticated SQLi
63RISCO
abrir ↗
Nucleimedium
TrakSYS 11.x.x - Sensitive Data Exposure
CVE-2024-6188MEDIUM
Parsec Automation TrackSYS pagedefinition direct request
28RISCO
abrir ↗
Nucleicritical
PayPlus Payment Gateway < 6.6.9 - SQL Injection
CVE-2024-6205HIGH
PayPlus Payment Gateway < 6.6.9 - Unauthenticated SQLi
56RISCO
abrir ↗
Nucleicritical
WordPress Keydatas ≤ 2.5.2 - Arbitrary File Upload
CVE-2024-6220CRITICAL
简数采集器 (Keydatas) <= 2.5.2 - Unauthenticated Arbitrary File Upload
55RISCO
abrir ↗
Nucleicritical
NetScaler Console - Sensitive Information Disclosure
CVE-2024-6235CRITICAL
Sensitive information disclosure
48RISCO
abrir ↗
Nucleihigh
LOLLMS WebUI - Absolute Path Traversal
CVE-2024-6250HIGH
Absolute Path Traversal in parisneo/lollms-webui
36RISCO
abrir ↗
Nucleicritical
UsersWP <= 1.2.10 - Unauthenticated SQL Injection
CVE-2024-6265CRITICAL
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by'
43RISCO
abrir ↗
Nucleimedium
WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure
CVE-2024-6289MEDIUM
WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure
28RISCO
abrir ↗
Nucleihigh
User Profile Builder < 3.11.8 - File Upload
CVE-2024-6366CRITICAL
User Profile Builder < 3.11.8 - Unauthenticated Media Upload
68RISCO
abrir ↗
Nucleicritical
Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite
CVE-2024-6396CRITICAL
Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim
55RISCO
abrir ↗
Nucleihigh
Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure
CVE-2024-6420HIGH
Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure
36RISCO
abrir ↗
Nucleicritical
WordPress Grow by Tradedoubler Plugin < 2.0.22 - Unauthenticated Local File Inclusion
CVE-2024-6460CRITICAL
Grow by Tradedoubler <= 2.0.21 - Unauthenticated LFI
63RISCO
abrir ↗
Nucleimedium
Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting
CVE-2024-6517MEDIUM
Contact Form 7 Math Captcha <= 2.0.1 - Reflected XSS
28RISCO
abrir ↗
Nucleimedium
WP Popups - Information Disclosure
CVE-2024-6555MEDIUM
WP Popups – WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosure
28RISCO
abrir ↗
Nucleimedium
Campaign Monitor for WordPress - Information Disclosure
CVE-2024-6569MEDIUM
Campaign Monitor for WordPress <= 2.8.15 - Unauthenticated Full Path Disclosure
28RISCO
abrir ↗
Nucleihigh
Lightdash v0.1024.6 - Server-Side Request Forgery
CVE-2024-6586HIGH
Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and s
36RISCO
abrir ↗
Nucleicritical
SPIP Porte Plume Plugin - Remote Code Execution
CVE-2024-7954CRITICAL
SPIP porte_plume Plugin Arbitrary PHP Execution
85RISCO
abrir ↗
← anteriorpágina 101 / 141próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.