Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
86.679exploits catalogados
40.329CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.150Exploit-DB 24.488GitHub PoC 17.946VulnCheck XDB 10.016Nuclei 4.547Metasploit 3.532✓ só verificadosrecentespopularesrisco
86.679 exploits
Exploit-DB
Cab Booking Script 1.0 - 'city' SQL Injection
Cab Booking Script 1.0 has SQL Injection via the /service-list city parameter.
23RISCO
abrir ↗GitHub PoC★ 3
RTF Cleaner, tries to extract URL from malicious RTF samples using CVE-2017-0199 & CVE-2017-8759
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Window
100RISCO
abrir ↗Exploit-DB
Event Calendar Category Script 1.0 - 'city' SQL Injection
Event Search Script 1.0 has SQL Injection via the /event-list city parameter.
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
FS Makemytrip Clone 1.0 - 'fl_orig' / 'fl_dest' SQL Injection
FS Makemytrip Clone 1.0 has SQL Injection via the show-flight-result.php fl_orig or fl_dest parameter.
23RISCO
abrir ↗Exploit-DB
Doctor Search Script 1.0 - 'city' SQL Injection
Doctor Search Script 1.0 has SQL Injection via the /list city parameter.
23RISCO
abrir ↗Exploit-DB
Co-work Space Search Script 1.0 - 'city' SQL Injection
Co-work Space Search Script 1.0 has SQL Injection via the /list city parameter.
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
FS Monster Clone 1.0 - 'Employer_Details.php?id' SQL Injection
FS Monster Clone 1.0 has SQL Injection via the Employer_Details.php id parameter.
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
FS Stackoverflow Clone 1.0 - 'keywords' SQL Injection
FS Stackoverflow Clone 1.0 has SQL Injection via the /question keywords parameter.
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Linux Kernel 4.10.5 / < 4.14.3 (Ubuntu) - DCCP Socket Use-After-Free
The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privilege
23RISCO
abrir ↗Exploit-DB
Apple macOS High Sierra 10.13 - 'ctl_ctloutput-leak' Information Leak
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS b
23RISCO
abrir ↗Exploit-DB
Claymore Dual ETH + DCR/SC/LBC/PASC GPU Miner - Stack Buffer Overflow / Path Traversal
The remote management interface on the Claymore Dual GPU miner 10.1 is vulnerable to an authenticated directory traversa
28RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Wireshark 2.4.0 < 2.4.2 / 2.2.0 < 2.2.10 - CIP Safety Dissector Crash
In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. This was addressed in epan/dissec
28RISCO
abrir ↗Exploit-DB
Claymore Dual ETH + DCR/SC/LBC/PASC GPU Miner - Stack Buffer Overflow / Path Traversal
The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute
35RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Hashicorp vagrant-vmware-fusion 5.0.1 - Local Privilege Escalation
In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently su
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Arq 5.9.7 - Local Privilege Escalation
The (1) arq_updater, (2) arqcommitter, (3) standardrestorer, (4) arqglacierrestorer, and (5) arqs3glacierrestorer helper
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Hashicorp vagrant-vmware-fusion 5.0.3 - Local Privilege Escalation
If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a loc
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Hashicorp vagrant-vmware-fusion 4.0.23 - Local Privilege Escalation
HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.24 uses weak permissions for the sudo help
23RISCO
abrir ↗Exploit-DB
Proxifier for Mac 2.19 - Local Privilege Escalation
Proxifier for Mac before 2.19.2, when first run, allows local users to gain privileges by replacing the KLoader binary w
23RISCO
abrir ↗Exploit-DB
Sera 1.2 - Local Privilege Escalation / Password Disclosure
Sera 1.2 stores the user's login password in plain text in their home directory. This makes privilege escalation trivial
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Hashicorp vagrant-vmware-fusion 5.0.0 - Local Privilege Escalation
In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.0, a local attacker or malware can silently su
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Hashicorp vagrant-vmware-fusion 4.0.24 - Local Privilege Escalation
An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 4.0.24 and ear
23RISCO
abrir ↗GitHub PoC
acidburnmi/CVE-2016-5195-master
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Arq 5.9.6 - Local Privilege Escalation
The setpermissions function in the auto-updater in Arq before 5.9.7 for Mac allows local users to gain root privileges v
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Perspective ICM Investigation & Case 5.1.1.16 - Privilege Escalation
Perspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions and c
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Readymade Classifieds Script 1.0 - SQL Injection
Posty Readymade Classifieds Script 1.0 allows an attacker to inject SQL commands via a listings.php?catid= or ads-detail
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Techno Portfolio Management Panel - 'id' SQL Injection
Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request.
23RISCO
abrir ↗GitHub PoC★ 21
Better Exploit Code For CVE 2017 9805 apache struts
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with a
100RISCO
abrir ↗VulnCheck XDB
initial-access
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with a
100RISCO
abrir ↗GitHub PoC
chu1337/CVE-2017-1000117
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
60RISCO
abrir ↗Exploit-DB
Ruby < 2.2.8 / < 2.3.5 / < 2.4.2 / < 2.5.0-preview1 - 'NET::Ftp' Command Injection
Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and p
45RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.