Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
86.555exploits catalogados
40.282CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.110Exploit-DB 24.488GitHub PoC 17.863VulnCheck XDB 10.015Nuclei 4.547Metasploit 3.532✓ só verificadosrecentespopularesrisco
86.558 exploits
GitHub PoC★ 267
A code demonstrating CVE-2018-0886
The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 S
45RISCO
abrir ↗GitHub PoC
Cisco VPN Client - Integer Overflow Denial of Service
The StartServiceCtrlDispatcher function in the cvpnd service (cvpnd.exe) in Cisco VPN client for Windows before 5.0.06.0
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
WampServer 3.1.1 - Cross-Site Scripting / Cross-Site Request Forgery
Cross-site scripting (XSS) vulnerability in WampServer 3.1.1 allows remote attackers to inject arbitrary web script or H
23RISCO
abrir ↗Exploit-DB
OpenCMS 10.5.3 - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to in
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
WampServer 3.1.2 - Cross-Site Request Forgery
Wampserver before 3.1.3 has CSRF in add_vhost.php.
23RISCO
abrir ↗Exploit-DB
DLink DIR-601 - Admin Password Disclosure
An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as, but being unauthenticat
23RISCO
abrir ↗Exploit-DB
Frog CMS 0.9.5 - Cross-Site Request Forgery (Add User)
An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CS
23RISCO
abrir ↗GitHub PoC★ 49
An implementation of CVE-2016-0974 for the Nintendo Wii.
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and
35RISCO
abrir ↗GitHub PoC
tomcat7.x远程命令执行
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisati
100RISCO
abrir ↗GitHub PoC★ 113
CVE-2018-7600 Drupal RCE
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISCO
abrir ↗Exploit-DB
Open-AuditIT Professional 2.1 - Cross-Site Request Forgery
Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences via the cre
23RISCO
abrir ↗VulnCheck XDB
initial-access
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISCO
abrir ↗VulnCheck XDB
initial-access
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISCO
abrir ↗Exploit-DB
MiniCMS 1.10 - Cross-Site Request Forgery
There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password.
23RISCO
abrir ↗Exploit-DB
WordPress Plugin WP Security Audit Log 3.1.1 - Sensitive Information Disclosure
An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-securit
43RISCO
abrir ↗Exploit-DB
Homematic CCU2 2.29.23 - Arbitrary File Write
Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic C
35RISCO
abrir ↗Exploit-DB
D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router - Authentication Bypass
An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Versi
28RISCO
abrir ↗Exploit-DB
Systematic SitAware - NVG Denial of Service
Systematic SitaWare 6.4 SP2 does not validate input from other sources sufficiently. e.g., information utilizing the NVG
23RISCO
abrir ↗GitHub PoC★ 353
💀Proof-of-Concept for CVE-2018-7600 Drupal SA-CORE-2018-002
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Joomla! Component Acymailing Starter 5.9.5 - CSV Macro Injection
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcyMailing exte
23RISCO
abrir ↗Exploit-DB
Homematic CCU2 2.29.23 - Remote Command Execution
Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers
35RISCO
abrir ↗Exploit-DB
WordPress Plugin Contact Form 7 to Database Extension 2.10.32 - CSV Injection
CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPr
23RISCO
abrir ↗Exploit-DB
WordPress Plugin Relevanssi 4.0.4 - Reflected Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in lib/interface.php of the Relevanssi plugin 4.0.4 for WordPress allows remote
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Joomla! Component AcySMS 3.5.0 - CSV Macro Injection
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcySMS extensio
23RISCO
abrir ↗Exploit-DB
Vtiger CRM 6.3.0 - (Authenticated) Arbitrary File Upload (Metasploit)
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger
43RISCO
abrir ↗GitHub PoC
lucad93/CVE-2018-3810
Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unau
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Joomla! Component Fields - SQLi Remote Code Execution (Metasploit)
SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspeci
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Exodus Wallet (ElectronJS Framework) - Remote Code Execution (Metasploit)
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the pro
60RISCO
abrir ↗Exploit-DB
Cisco Smart Install - Crash (PoC)
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthentica
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
GitStack - Unsanitized Argument Remote Code Execution (Metasploit)
An issue was discovered in GitStack through 2.3.10. User controlled input is not sufficiently filtered, allowing an unau
60RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.