Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
86.634exploits catalogados
40.286CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.110Exploit-DB 24.488GitHub PoC 17.941VulnCheck XDB 10.016Nuclei 4.547Metasploit 3.532✓ só verificadosrecentespopularesrisco
86.634 exploits
GitHub PoC★ 22
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RISCO
abrir ↗Exploit-DB
Huawei Router HG532 - Arbitrary Command Execution
Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could se
45RISCO
abrir ↗VulnCheck XDB
initial-access
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RISCO
abrir ↗GitHub PoC★ 26
CVE-2017-17215 HuaWei Router RCE (NOT TESTED)
Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could se
45RISCO
abrir ↗GitHub PoC★ 3
Simplified PoC for Weblogic-CVE-2017-10271
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RISCO
abrir ↗GitHub PoC★ 39
CVE-2017-10271 WEBLOGIC RCE (TESTED)
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RISCO
abrir ↗Exploit-DB
Iopsys Router - 'dhcp' Remote Code Execution
Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying th
28RISCO
abrir ↗VulnCheck XDB
initial-access
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RISCO
abrir ↗GitHub PoC★ 15
CVE-2017-12149 JBOSS RCE (TESTED)
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter
100RISCO
abrir ↗VulnCheck XDB
initial-access
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter
100RISCO
abrir ↗Exploit-DB
Samsung Internet Browser - SOP Bypass (Metasploit)
Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive informat
60RISCO
abrir ↗Exploit-DB
BEIMS ContractorWeb 5.18.0.0 - SQL Injection
CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, ass
23RISCO
abrir ↗Exploit-DB
Ability Mail Server 3.3.2 - Cross-Site Scripting
Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code execute
23RISCO
abrir ↗Exploit-DB
Conarc iChannel - Improper Access Restrictions
Conarc iChannel allows remote attackers to obtain sensitive information, modify the configuration, or cause a denial of
28RISCO
abrir ↗Exploit-DB
Ichano AtHome IP Cameras - Multiple Vulnerabilities
An issue was discovered on Ichano AtHome IP Camera devices. The device runs the "noodles" binary - a service on port 130
23RISCO
abrir ↗Exploit-DB
BrightSign Digital Signage - Multiple Vulnerablities
The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the REF parameter to /network_diag
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - 'jscript!RegExpComp::Compile' Heap Overflow Through IE or Local Network via WPAD
Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Win
35RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Tuleap 9.6 - Second-Order PHP Object Injection (Metasploit)
An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentEl
50RISCO
abrir ↗Exploit-DB
Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below coul
28RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Intel Content Protection HECI Service - Type Confusion Privilege Escalation
Type Confusion in Content Protection HECI Service in Intel Graphics Driver allows unprivileged user to elevate privilege
23RISCO
abrir ↗Exploit-DB
Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to pe
28RISCO
abrir ↗VulnCheck XDB
initial-access
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - 'jscript!JsArraySlice' Uninitialized Variable
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Window
35RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 11 - 'jscript!JSONStringifyObject' Use-After-Free
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Window
35RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Jenkins - XStream Groovy classpath Deserialization (Metasploit)
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
60RISCO
abrir ↗Exploit-DB
Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to pe
28RISCO
abrir ↗GitHub PoC★ 2
CVE-2017-15944 Palo Alto Networks firewalls remote root code execution POC
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote
100RISCO
abrir ↗Exploit-DB
BrightSign Digital Signage - Multiple Vulnerablities
The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) allows renaming and modifying files via /tools
23RISCO
abrir ↗Exploit-DB
BrightSign Digital Signage - Multiple Vulnerablities
The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal via the /storage.html
28RISCO
abrir ↗Exploit-DB
Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 an
23RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.