Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

86.508exploits catalogados
40.258CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.095Exploit-DB 24.488GitHub PoC 17.831VulnCheck XDB 10.015Nuclei 4.547Metasploit 3.532✓ só verificadosrecentespopularesrisco
86.508 exploits
Exploit-DB✓ VexDay Proof
DHCP Client - Command Injection 'DynoRoot' (Metasploit)
CVE-2018-1111HIGHremotelinux13 jun 2018
DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in
78RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
glibc - 'realpath()' Privilege Escalation (Metasploit)
CVE-2018-1000001—locallinux13 jun 2018
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before th
43RISCO
abrir ↗
Exploit-DB
MACCMS 10 - Cross-Site Request Forgery (Add User)
CVE-2018-12114—webappsphp13 jun 2018
Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts.
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows 10 - Child Process Restriction Mitigation Bypass
CVE-2018-0982—localwindows13 jun 2018
An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows
23RISCO
abrir ↗
Exploit-DB
RSLinx Classic and FactoryTalk Linx Gateway - Privilege Escalation
CVE-2018-10619—localwindows13 jun 2018
An unquoted search path or element in RSLinx Classic Versions 3.90.01 and prior and FactoryTalk Linx Gateway Versions 3.
23RISCO
abrir ↗
GitHub PoC★ 18
empty_list - exploit for p0 issue 1564 (CVE-2018-4243) iOS 11.0 - 11.3.1 kernel r/w
CVE-2018-4243—13 jun 2018
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b
28RISCO
abrir ↗
GitHub PoC
CVE-2018-4878 flash 0day
CVE-2018-4878HIGHsob ataqueransomware12 jun 2018
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to
93RISCO
abrir ↗
Exploit-DB
OX App Suite 7.8.4 - Multiple Vulnerabilities
CVE-2018-5754—webappsxml12 jun 2018
Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and
23RISCO
abrir ↗
Exploit-DB
OX App Suite 7.8.4 - Multiple Vulnerabilities
CVE-2018-5751—webappsxml12 jun 2018
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev4
23RISCO
abrir ↗
Exploit-DB
OX App Suite 7.8.4 - Multiple Vulnerabilities
CVE-2018-5753—webappsxml12 jun 2018
The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev
23RISCO
abrir ↗
Exploit-DB
OX App Suite 7.8.4 - Multiple Vulnerabilities
CVE-2018-5752—webappsxml12 jun 2018
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev4
23RISCO
abrir ↗
Exploit-DB
OX App Suite 7.8.4 - Multiple Vulnerabilities
CVE-2018-5756—webappsxml12 jun 2018
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev4
23RISCO
abrir ↗
Exploit-DB
Canon PrintMe EFI - Cross-Site Scripting
CVE-2018-12111—webappsphp12 jun 2018
Cross-site scripting (XSS) vulnerability in the Canon PrintMe EFI webinterface allows remote attackers to inject arbitra
23RISCO
abrir ↗
Exploit-DB
OX App Suite 7.8.4 - Multiple Vulnerabilities
CVE-2018-5755—webappsxml12 jun 2018
Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.
23RISCO
abrir ↗
Exploit-DB
OX App Suite 7.8.4 - Multiple Vulnerabilities
CVE-2017-17062—webappsxml12 jun 2018
The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev4
23RISCO
abrir ↗
Exploit-DB
WebKitGTK+ < 2.21.3 - 'WebKitFaviconDatabase' Denial of Service (Metasploit)
CVE-2018-11646—doslinux11 jun 2018
webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFavicon
50RISCO
abrir ↗
Exploit-DB
Schools Alert Management Script - SQL Injection
CVE-2018-12055—webappsphp11 jun 2018
Multiple SQL Injections exist in PHP Scripts Mall Schools Alert Management Script via crafted POST data in contact_us.ph
23RISCO
abrir ↗
Exploit-DB
WordPress Plugin Pie Register < 3.0.9 - Blind SQL Injection
CVE-2018-10969—webappsphp11 jun 2018
SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute ar
23RISCO
abrir ↗
Exploit-DB
Schools Alert Management Script - 'get_sec.php' SQL Injection
CVE-2018-12052—webappsphp11 jun 2018
SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in get_sec.php.
23RISCO
abrir ↗
Exploit-DB
Schools Alert Management Script - Arbitrary File Deletion
CVE-2018-12053—webappsphp11 jun 2018
Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in delete_img.p
28RISCO
abrir ↗
Exploit-DB
Schools Alert Management Script - Arbitrary File Read
CVE-2018-12054—webappsphp11 jun 2018
Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absol
50RISCO
abrir ↗
GitHub PoC★ 11
A demonstration of how page tables can be used to run arbitrary code in ring-0 and lead to a privesc. Uses CVE-2016-7255 as an example.
CVE-2016-7255HIGHsob ataqueransomware09 jun 2018
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,
93RISCO
abrir ↗
VulnCheck XDB
local
CVE-2016-7255HIGHsob ataqueransomware09 jun 2018
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,
93RISCO
abrir ↗
GitHub PoC
teawater/CVE-2017-5123
CVE-2017-5123—08 jun 2018
Insufficient data validation in waitid allowed an user to escape sandboxes on Linux.
23RISCO
abrir ↗
Exploit-DB
Splunk < 7.0.1 - Information Disclosure
CVE-2018-11409—webappslinux08 jun 2018
Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json
60RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
WebRTC - VP9 Missing Frame Processing Out-of-Bounds Memory Access
CVE-2018-6129—dosmultiple08 jun 2018
Out of bounds array access in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially per
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
TrendMicro OfficeScan XG 11.0 - Change Prevention Bypass
CVE-2018-10507—localwindows08 jun 2018
A vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a attacker to take a series of steps to bypass or
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
WebKit - Use-After-Free when Resuming Generator
CVE-2018-4218—dosmultiple08 jun 2018
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud
23RISCO
abrir ↗
Exploit-DB
XiongMai uc-httpd 1.0.0 - Buffer Overflow
CVE-2018-10088—webappshardware08 jun 2018
Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE
50RISCO
abrir ↗
Metasploit300
Splunk __raw Server Info Disclosure
CVE-2018-11409—08 jun 2018
Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json
60RISCO
abrir ↗
← anteriorpágina 1020 / 2.884próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.