Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

86.634exploits catalogados
40.286CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.110Exploit-DB 24.488GitHub PoC 17.941VulnCheck XDB 10.016Nuclei 4.547Metasploit 3.532✓ só verificadosrecentespopularesrisco
86.634 exploits
Exploit-DB
Multilanguage Real Estate MLM Script 3.0 - 'srch' SQL Injection
CVE-2018-6364—webappsphp28 jan 2018
SQL Injection exists in Multilanguage Real Estate MLM Script through 3.0 via the /product-list.php srch parameter.
23RISCO
abrir ↗
Exploit-DB
KeystoneJS < 4.0.0-beta.7 - Cross-Site Request Forgery
CVE-2017-16570—webappsnodejs28 jan 2018
KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureL
23RISCO
abrir ↗
Exploit-DB
Task Rabbit Clone 1.0 - 'id' SQL Injection
CVE-2018-6363—webappsphp28 jan 2018
SQL Injection exists in Task Rabbit Clone 1.0 via the single_blog.php id parameter.
23RISCO
abrir ↗
Exploit-DB
BMC BladeLogic 8.3.00.64 - Remote Command Execution
CVE-2016-5063—remotemultiple26 jan 2018
The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote atta
23RISCO
abrir ↗
Exploit-DB
Dodocool DC38 N300 - Cross-site Request Forgery
CVE-2018-5720—webappshardware26 jan 2018
An issue was discovered on DODOCOOL DC38 3-in-1 N300 Mini Wireless Range Extend RTN2-AW.GD.R3465.1.20161103 devices. A C
23RISCO
abrir ↗
Exploit-DB
BMC BladeLogic 8.3.00.64 - Remote Command Execution
CVE-2016-1543—remotemultiple26 jan 2018
The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux a
60RISCO
abrir ↗
Exploit-DB
BMC BladeLogic 8.3.00.64 - Remote Command Execution
CVE-2016-1542—remotemultiple26 jan 2018
The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and U
60RISCO
abrir ↗
Exploit-DB
Exodus Wallet (ElectronJS Framework) - Remote Code Execution
CVE-2018-1000006—remotewindows25 jan 2018
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the pro
60RISCO
abrir ↗
GitHub PoC★ 39
The Demo for CVE-2018-1000006
CVE-2018-1000006—25 jan 2018
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the pro
60RISCO
abrir ↗
Metasploit0
Exodus Wallet (ElectronJS Framework) remote Code Execution
CVE-2018-1000006—25 jan 2018
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the pro
60RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Kaltura - Remote PHP Code Execution over Cookie (Metasploit)
CVE-2017-14143—remotephp24 jan 2018
The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, wh
60RISCO
abrir ↗
Exploit-DB
Oracle VirtualBox < 5.1.30 / < 5.2-rc1 - Guest to Host Escape
CVE-2018-2698—localmultiple24 jan 2018
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions th
23RISCO
abrir ↗
Exploit-DB
RAVPower 2.000.056 - Root Remote Code Execution
CVE-2018-5997—remotehardware24 jan 2018
An issue was discovered in the HTTP Server in RAVPower Filehub 2.000.056. Due to an unrestricted upload feature and a pa
28RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Sync Breeze Enterprise 9.5.16 - 'Import Command' Buffer Overflow (Metasploit)
CVE-2017-7310—localwindows24 jan 2018
A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9
50RISCO
abrir ↗
Exploit-DB
Professional Local Directory Script 1.0 - SQL Injection
CVE-2018-5973—webappsphp24 jan 2018
SQL Injection exists in Professional Local Directory Script 1.0 via the sellers_subcategories.php IndustryID parameter,
28RISCO
abrir ↗
Exploit-DB
Telerik UI for ASP.NET AJAX 2012.3.1308 < 2017.1.118 - Encryption Keys Disclosure
CVE-2017-9248CRITICALsob ataquewebappsaspx24 jan 2018
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not
100RISCO
abrir ↗
GitHub PoC
CVE-2017-7269利用代码（rb文件）
CVE-2017-7269CRITICALsob ataque24 jan 2018
Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in
100RISCO
abrir ↗
Exploit-DB
Telerik UI for ASP.NET AJAX 2012.3.1308 < 2017.1.118 - Arbitrary File Upload
CVE-2017-11317CRITICALsob ataquewebappsaspx24 jan 2018
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload
100RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
GoAhead Web Server 2.5 < 3.6.5 - HTTPd 'LD_PRELOAD' Arbitrary Module Load (Metasploit)
CVE-2017-17562HIGHsob ataqueremotemultiple24 jan 2018
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. T
100RISCO
abrir ↗
Exploit-DB
Telerik UI for ASP.NET AJAX 2012.3.1308 < 2017.1.118 - Arbitrary File Upload
CVE-2017-11357CRITICALsob ataqueransomwarewebappsaspx24 jan 2018
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which a
100RISCO
abrir ↗
GitHub PoC★ 20
BMC Bladelogic RSCD exploits including remote code execution - CVE-2016-1542, CVE-2016-1543, CVE-2016-5063
CVE-2016-1542—24 jan 2018
The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and U
60RISCO
abrir ↗
Exploit-DB
Quickad 4.0 - SQL Injection
CVE-2018-5972—webappsphp23 jan 2018
SQL Injection exists in Classified Ads CMS Quickad 4.0 via the keywords, placeid, cat, or subcat parameter to the listin
28RISCO
abrir ↗
Exploit-DB
Zechat 1.5 - SQL Injection
CVE-2018-5978—webappsphp23 jan 2018
SQL Injection exists in Facebook Style Php Ajax Chat Zechat 1.5 via the login.php User field.
23RISCO
abrir ↗
Exploit-DB
Easy Car Script 2014 - SQL Injection
CVE-2018-5986—webappsphp23 jan 2018
SQL Injection exists in Easy Car Script 2014 via the s_order or s_row parameter to site_search.php.
23RISCO
abrir ↗
Exploit-DB
Photography CMS 1.0 - Cross-Site Request Forgery (Add Admin)
CVE-2018-5969—webappsphp23 jan 2018
Cross Site Request Forgery (CSRF) exists in Photography CMS 1.0 via clients/resources/ajax/ajax_new_admin.php, as demons
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
HP Connected Backup 8.6/8.8.6 - Local Privilege Escalation
CVE-2017-14355—localwindows23 jan 2018
A potential security vulnerability has been identified in HPE Connected Backup versions 8.6 and 8.8.6. The vulnerability
23RISCO
abrir ↗
Exploit-DB
Flexible Poll 1.2 - SQL Injection
CVE-2018-5988—webappsphp23 jan 2018
SQL Injection exists in Flexible Poll 1.2 via the id parameter to mobile_preview.php or index.php.
28RISCO
abrir ↗
Exploit-DB
Affiligator 2.1.0 - SQL Injection
CVE-2018-5977—webappsphp23 jan 2018
SQL Injection exists in Affiligator Affiliate Webshop Management System 2.1.0 via a search/?q=&price_type=range&price= r
23RISCO
abrir ↗
Exploit-DB
LiveCRM SaaS Cloud 1.0 - SQL Injection
CVE-2018-5985—webappsphp23 jan 2018
SQL Injection exists in the LiveCRM SaaS Cloud 1.0 component for Joomla! via an r=site/login&company_id= request.
28RISCO
abrir ↗
Exploit-DB
RAVPower 2.000.056 - Memory Disclosure
CVE-2018-5319—doshardware23 jan 2018
RAVPower FileHub 2.000.056 allows remote users to steal sensitive information via a crafted HTTP request.
28RISCO
abrir ↗
← anteriorpágina 1051 / 2.888próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.