Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.886exploits catalogados

32.153CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 19.978GitHub PoC 13.282VulnCheck XDB 8.176Nuclei 4.202Metasploit 3.462✓ só verificadosrecentes populares risco

4.202 exploits

Nucleicritical

LearnPress Plugin < 4.2.0 - Unauthenticated Time-Based Blind SQLi

CVE-2022-45808CRITICAL

WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection

63RISCO

abrir ↗

Nucleihigh

WordPress PhonePe Payment Solutions <=1.0.15 - Server-Side Request Forgery

CVE-2022-45835MEDIUM

WordPress PhonePe Payment Solutions Plugin <= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF)

40RISCO

abrir ↗

Nucleimedium

CVE-2023-1893—

18RISCO

abrir ↗

Nucleicritical

Cisco VPN Routers - Unauthenticated Arbitrary File Upload

CVE-2023-20073MEDIUM

Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Arbitrary File Upload Vulnerability

70RISCO

abrir ↗

Nucleimedium

Pretty Url <= 1.5.4 - Cross-Site Scripting

CVE-2023-2009MEDIUM

Pretty Url <= 1.5.4 - Admin+ Stored XSS in plugin settings

28RISCO

abrir ↗

Nucleicritical

Cisco IOS XE Web UI - Command Injection

CVE-2023-20198CRITICALsob ataque

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS

100RISCO

abrir ↗

Nucleimedium

Custom 404 Pro < 3.7.3 - Cross-Site Scripting

CVE-2023-2023MEDIUM

Custom 404 Pro < 3.7.3 - Reflected Cross-Site Scripting

28RISCO

abrir ↗

Nucleimedium

DedeCMS 5.7.87 - Directory Traversal

CVE-2023-2059MEDIUM

DedeCMS select_templets.php path traversal

28RISCO

abrir ↗

Nucleicritical

VMware Aria Operations for Logs - Unauthenticated Remote Code Execution

CVE-2023-20864CRITICAL

VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with netwo

65RISCO

abrir ↗

Nucleicritical

VMware VRealize Network Insight - Remote Code Execution

CVE-2023-20887CRITICALsob ataque

Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware

100RISCO

abrir ↗

Nucleihigh

VMware Aria Operations for Networks - Remote Code Execution

CVE-2023-20888HIGH

Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network acc

58RISCO

abrir ↗

Nucleihigh

VMware Aria Operations for Networks - Code Injection Information Disclosure Vulnerability

CVE-2023-20889HIGH

Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to

58RISCO

abrir ↗

Nucleimedium

Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting

CVE-2023-2122—

Image Optimizer by 10web < 1.0.27 - Reflected Cross-Site Scripting

18RISCO

abrir ↗

Nucleicritical

Purchase Order Management v1.0 - SQL Injection

CVE-2023-2130MEDIUM

SourceCodester Purchase Order Management System GET Parameter view_details.php sql injection

28RISCO

abrir ↗

Nucleimedium

Aajoda Testimonials < 2.2.2 - Cross-Site Scripting

CVE-2023-2178—

Aajoda Testimonials < 2.2.2 - Admin+ Stored XSS

18RISCO

abrir ↗

Nucleihigh

Oracle Peoplesoft - Unauthenticated File Read

CVE-2023-22047HIGH

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported vers

58RISCO

abrir ↗

Nucleimedium

Adobe Connect < 12.1.5 - Local File Disclosure

CVE-2023-22232MEDIUM

Adobe Connect Improper Access Control Security feature bypass

70RISCO

abrir ↗

Nucleimedium

Seo By 10Web < 1.2.7 - Cross-Site Scripting

CVE-2023-2224MEDIUM

Seo By 10Web < 1.2.7 - Admin+ Stored XSS

28RISCO

abrir ↗

Nucleicritical

Modoboa < 2.1.0 - Improper Authorization

CVE-2023-2227CRITICAL

Improper Authorization in modoboa/modoboa

55RISCO

abrir ↗

Nucleimedium

Web2py URL - Open Redirect

CVE-2023-22432MEDIUM

Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirec

28RISCO

abrir ↗

Nucleicritical

KubePi JwtSigKey - Admin Authentication Bypass

CVE-2023-22463CRITICAL

KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token

55RISCO

abrir ↗

Nucleihigh

KubePi <= v1.6.4 LoginLogsSearch - Unauthorized Access

CVE-2023-22478HIGH

KubePi is vulnerable to missing authorization

36RISCO

abrir ↗

Nucleicritical

KubeOperator Foreground `kubeconfig` - File Download

CVE-2023-22480HIGH

KubeOperator is vulnerable to unauthorized access to system API

48RISCO

abrir ↗

Nucleicritical

Atlassian Confluence - Privilege Escalation

CVE-2023-22515CRITICALsob ataqueransomware

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited

100RISCO

abrir ↗

Nucleicritical

Atlassian Confluence Server - Improper Authorization

CVE-2023-22518CRITICALsob ataqueransomware

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authoriz

100RISCO

abrir ↗

Nucleilow

Directorist < 7.5.4 - Local File Inclusion

CVE-2023-2252LOW

Directorist < 7.5.4 - Admin+ LFI

23RISCO

abrir ↗

Nucleicritical

Atlassian Confluence - Remote Code Execution

CVE-2023-22527CRITICALsob ataqueransomware

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated atta

100RISCO

abrir ↗

Nucleihigh

WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting

CVE-2023-2256—

Product Addons & Fields for WooCommerce < 32.0.7 - Reflected Cross-Site Scripting

18RISCO

abrir ↗

Nucleihigh

SecurePoint UTM 12.x Session ID Leak

CVE-2023-22620HIGH

An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows sessionid infor

36RISCO

abrir ↗

Nucleihigh

Strapi Versions <=4.5.5 - SSTI to Remote Code Execution

CVE-2023-22621CRITICAL

Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitra

85RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.