Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
86.508exploits catalogados
40.258CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.095Exploit-DB 24.488GitHub PoC 17.831VulnCheck XDB 10.015Nuclei 4.547Metasploit 3.532✓ só verificadosrecentespopularesrisco
86.508 exploits
Exploit-DB
iScripts Easycreate 3.2.1 - Stored Cross-Site Scripting
iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.
23RISCO
abrir ↗Exploit-DB
WordPress Plugin Activity Log 2.4.0 - Stored Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote a
23RISCO
abrir ↗Exploit-DB
WUZHI CMS 4.1.0 - Cross-Site Request Forgery (Add Admin)
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add an admin account via index.php?m=
23RISCO
abrir ↗Exploit-DB
WordPress Plugin File Upload 4.3.2 - Stored Cross-Site Scripting
The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes.
23RISCO
abrir ↗Exploit-DB
Dell EMC Avamar and Integrated Data Protection Appliance Installation Manager - Invalid Access Control
Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection A
50RISCO
abrir ↗Exploit-DB
DVD X Player Standard 5.5.3.9 - Buffer Overflow
DVD X Player Standard 5.5.3.9 has a Buffer Overflow via a crafted .plf file, a related issue to CVE-2007-3068.
23RISCO
abrir ↗Exploit-DB
iScripts Easycreate 3.2.1 - Stored Cross-Site Scripting
iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field.
23RISCO
abrir ↗Exploit-DB
WordPress Plugin File Upload 4.3.3 - Stored Cross-Site Scripting (PoC)
The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS.
23RISCO
abrir ↗GitHub PoC★ 13
Fixed No Virus Manual Automatic Loader exe no zip because zip picks up the anti virus detector.
Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Ser
93RISCO
abrir ↗Exploit-DB
Yahei PHP Prober 0.4.7 - Cross-Site Scripting
proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter.
23RISCO
abrir ↗Exploit-DB
WolfCMS 0.8.3.1 - Open Redirection
Open redirect vulnerability in the login[redirect] parameter login functionality in WolfCMS 0.8.3.1 allows remote attack
23RISCO
abrir ↗Exploit-DB
WolfCMS 0.8.3.1 - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in WolfCMS 0.8.3.1 allows remote attackers to hijack the authentication
23RISCO
abrir ↗Exploit-DB
WordPress Plugin Background Takeover < 4.1.4 - Directory Traversal
exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Direct
50RISCO
abrir ↗Metasploit600
H2 Web Interface Create Alias RCE
H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can
30RISCO
abrir ↗Exploit-DB✓ VexDay Proof
WebKit - WebAssembly Parsing Does not Correctly Check Section Order
An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud b
28RISCO
abrir ↗Exploit-DB
iScripts SonicBB 1.0 - Reflected Cross-Site Scripting (PoC)
iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php.
23RISCO
abrir ↗Exploit-DB
CyberArk Password Vault Web Access < 9.9.5 / < 9.10 / 10.1 - Remote Code Execution
The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute
28RISCO
abrir ↗Exploit-DB
CyberArk Password Vault < 9.7 / < 10 - Memory Disclosure
CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replay
28RISCO
abrir ↗Exploit-DB
Cobub Razor 0.7.2 - Add New Superuser Account
An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/install/inst
28RISCO
abrir ↗GitHub PoC★ 5
CVE-2017-8570生成脚本(CVE-2017-0199另一种利用方式)
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
93RISCO
abrir ↗VulnCheck XDB
client-side
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
93RISCO
abrir ↗Exploit-DB
Sophos Endpoint Protection 10.7 - Tamper-Protection Bypass
Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection mechanism by deleting the HKE
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Cobub Razor 0.7.2 - Cross-Site Request Forgery
An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/manage/chann
23RISCO
abrir ↗Exploit-DB
GNU Beep 1.3 - 'HoleyBeep' Local Privilege Escalation
Johnathan Nightingale beep through 1.3.4, if setuid, has a race condition that allows local privilege escalation.
23RISCO
abrir ↗Exploit-DB
DotNetNuke DNNarticle Module 11 - Directory Traversal
The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and conseque
35RISCO
abrir ↗GitHub PoC★ 2
Android Blueborne RCE CVE-2017-0781
A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1
28RISCO
abrir ↗Exploit-DB
LineageOS 14.1 Blueborne - Remote Code Execution
A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1
28RISCO
abrir ↗GitHub PoC★ 3
Android Blueborne RCE CVE-2017-0781
A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1
28RISCO
abrir ↗Exploit-DB
Adobe Flash < 28.0.0.161 - Use-After-Free
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to
93RISCO
abrir ↗Exploit-DB
Sophos Endpoint Protection Control Panel 10.7 - Weak Password Encryption
Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Vir
23RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.