Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
86.583exploits catalogados
40.286CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.110Exploit-DB 24.488GitHub PoC 17.890VulnCheck XDB 10.016Nuclei 4.547Metasploit 3.532✓ só verificadosrecentespopularesrisco
86.634 exploits
Exploit-DB
Vtiger CRM 6.3.0 - (Authenticated) Arbitrary File Upload (Metasploit)
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger
43RISCO
abrir ↗Exploit-DB
WordPress Plugin WP Security Audit Log 3.1.1 - Sensitive Information Disclosure
An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-securit
43RISCO
abrir ↗GitHub PoC★ 353
💀Proof-of-Concept for CVE-2018-7600 Drupal SA-CORE-2018-002
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISCO
abrir ↗Exploit-DB
WordPress Plugin Contact Form 7 to Database Extension 2.10.32 - CSV Injection
CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPr
23RISCO
abrir ↗Exploit-DB
WordPress Plugin Relevanssi 4.0.4 - Reflected Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in lib/interface.php of the Relevanssi plugin 4.0.4 for WordPress allows remote
23RISCO
abrir ↗VulnCheck XDB
initial-access
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISCO
abrir ↗Exploit-DB
MiniCMS 1.10 - Cross-Site Request Forgery
There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password.
23RISCO
abrir ↗GitHub PoC★ 113
CVE-2018-7600 Drupal RCE
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISCO
abrir ↗VulnCheck XDB
initial-access
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISCO
abrir ↗Exploit-DB
Open-AuditIT Professional 2.1 - Cross-Site Request Forgery
Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences via the cre
23RISCO
abrir ↗Exploit-DB
Systematic SitAware - NVG Denial of Service
Systematic SitaWare 6.4 SP2 does not validate input from other sources sufficiently. e.g., information utilizing the NVG
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Exodus Wallet (ElectronJS Framework) - Remote Code Execution (Metasploit)
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the pro
60RISCO
abrir ↗GitHub PoC
lucad93/CVE-2018-3810
Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unau
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Joomla! Component Fields - SQLi Remote Code Execution (Metasploit)
SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspeci
60RISCO
abrir ↗Exploit-DB
Cisco Smart Install - Crash (PoC)
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthentica
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
GitStack - Unsanitized Argument Remote Code Execution (Metasploit)
An issue was discovered in GitStack through 2.3.10. User controlled input is not sufficiently filtered, allowing an unau
60RISCO
abrir ↗Exploit-DB
Open-AuditIT Professional 2.1 - Cross-Site Scripting
Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.
23RISCO
abrir ↗Exploit-DB
TwonkyMedia Server 7.0.11-8.5 - Directory Traversal
Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of a
28RISCO
abrir ↗Exploit-DB
TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Remote Assistance - XML External Entity Injection
Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Window
33RISCO
abrir ↗Metasploit600
Drupal Drupalgeddon 2 Forms API Property Injection
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISCO
abrir ↗Exploit-DB
DLINK DCS-5020L - Remote Code Execution (PoC)
On D-Link DCS-5009 devices with firmware 1.08.11 and earlier, DCS-5010 devices with firmware 1.14.09 and earlier, and DC
28RISCO
abrir ↗GitHub PoC★ 5
CVE-2017-14322 Interspire Email Marketer (emailmarketer) Exploit
The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior
35RISCO
abrir ↗VulnCheck XDB
client-side
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
93RISCO
abrir ↗VulnCheck XDB
client-side
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
93RISCO
abrir ↗Exploit-DB
Microsoft Windows Manager (7 x86) - Menu Management Component UAF Privilege Elevation
The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012
76RISCO
abrir ↗Exploit-DB
Laravel Log Viewer < 0.13.0 - Local File Download
rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easi
28RISCO
abrir ↗Exploit-DB
Acrolinx Server < 5.2.5 - Directory Traversal
Acrolinx Server before 5.2.5 on Windows allows Directory Traversal.
50RISCO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Site Editor 1.1.1 - Local File Inclusion
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to re
50RISCO
abrir ↗Exploit-DB
Android Bluetooth - BNEP bnep_data_ind() Remote Heap Disclosure
In bnep_data_ind of bnep_main.cc, there is a possible out of bounds read due to a missing bounds check. This could lead
23RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.