Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
86.679exploits catalogados
40.329CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.150Exploit-DB 24.488GitHub PoC 17.946VulnCheck XDB 10.016Nuclei 4.547Metasploit 3.532✓ só verificadosrecentespopularesrisco
86.679 exploits
Exploit-DB✓ VexDay Proof
D-Link DIR-605L < 2.08 - Denial of Service
On D-Link DIR-605L devices, firmware before 2.08UIBetaB01.bin allows an unauthenticated GET request to trigger a reboot.
28RISCO
abrir ↗Exploit-DB
PSFTPd Windows FTP Server 10.0.4 Build 729 - Log Injection / Use-After-Free
The PSFTPd 10.0.4 Build 729 server does not properly escape data before writing it into a Comma Separated Values (CSV) f
23RISCO
abrir ↗GitHub PoC
Python exploit for CVE-2017-16806
The Process function in RemoteTaskServer/WebServer/HttpServer.cs in Ulterius before 1.9.5.0 allows HTTP server directory
60RISCO
abrir ↗Exploit-DB
IKARUS anti.virus 2.16.7 - 'ntguard_x64' Local Privilege Escalation
In IKARUS anti.virus 2.16.7, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating
23RISCO
abrir ↗GitHub PoC★ 160
Chrome < 62 uxss exploit (CVE-2017-5124)
Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject
23RISCO
abrir ↗Exploit-DB
Ulterius Server < 1.9.5.0 - Directory Traversal
The Process function in RemoteTaskServer/WebServer/HttpServer.cs in Ulterius before 1.9.5.0 allows HTTP server directory
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Kirby CMS < 2.5.7 - Cross-Site Scripting
A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exist
23RISCO
abrir ↗Exploit-DB
Web Viewer 1.0.0.193 (Samsung SRN-1670D) - Unrestricted File Upload
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_u
50RISCO
abrir ↗Metasploit500
Linux BPF Sign Extension Local Privilege Escalation
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial
50RISCO
abrir ↗Metasploit600
Polycom Shell HDX Series Traceroute Command Execution
Polycom HDX Series Telnet Command Injection via lan traceroute
36RISCO
abrir ↗Exploit-DB✓ VexDay Proof
MyBB 1.8.13 - Remote Code Execution
The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration fi
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
MyBB 1.8.13 - Cross-Site Scripting
The installer in MyBB before 1.8.13 has XSS.
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Symantec Endpoint Protection 12.1 - Tamper-Protection Bypass
Prior to SEP 14 RU1 Symantec Endpoint Protection product can encounter an issue of Tamper-Protection Bypass, which is a
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 11 - 'jscript!JsErrorToString' Use-After-Free
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Window
35RISCO
abrir ↗Metasploit300
Roundcube TimeZone Authenticated File Disclosure
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary file
98RISCO
abrir ↗Exploit-DB✓ VexDay Proof
PHP 7.1.8 - Heap Buffer Overflow
In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian hand
28RISCO
abrir ↗Metasploit300
Samsung Internet Browser SOP Bypass
Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive informat
60RISCO
abrir ↗Metasploit600
Synology DiskStation Manager smart.cgi Remote Command Execution
Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authe
60RISCO
abrir ↗GitHub PoC★ 1
Fork of github.com/spring-projects/spring-data-rest (vulnerable to CVE-2017-8046)
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions pri
60RISCO
abrir ↗Exploit-DB
ManageEngine Applications Manager 13 - SQL Injection
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name param
23RISCO
abrir ↗Exploit-DB
Ametys CMS 4.0.2 - Password Reset
Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to
23RISCO
abrir ↗Exploit-DB
ManageEngine Applications Manager 13 - SQL Injection
Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated
23RISCO
abrir ↗Metasploit600
pfSense authenticated group member RCE
pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_
30RISCO
abrir ↗Exploit-DB
Linux Kernel 4.13 (Ubuntu 17.10) - 'waitid()' SMEP/SMAP/Chrome Sandbox Privilege Escalation
Insufficient data validation in waitid allowed an user to escape sandboxes on Linux.
23RISCO
abrir ↗Exploit-DB
Avaya IP Office (IPO) < 10.1 - 'SoftConsole' Remote Buffer Overflow (SEH)
Buffer overflow in the SoftConsole client in Avaya IP Office before 10.1.1 allows remote servers to execute arbitrary co
23RISCO
abrir ↗Exploit-DB
Avaya IP Office (IPO) < 10.1 - ActiveX Buffer Overflow
Buffer overflow in the ViewerCtrlLib.ViewerCtrl ActiveX control in Avaya IP Office Contact Center before 10.1.1 allows r
28RISCO
abrir ↗GitHub PoC★ 4
Unrestricted file upload vulnerability - Web Viewer 1.0.0.193 on Samsung SRN-1670D
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_u
50RISCO
abrir ↗Exploit-DB
WordPress Plugin Userpro < 4.9.17.1 - Authentication Bypass
The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers
28RISCO
abrir ↗Exploit-DB
GraphicsMagick - Memory Disclosure / Heap Overflow
GraphicsMagick 1.3.26 is vulnerable to a memory information disclosure vulnerability found in the DescribeImage function
28RISCO
abrir ↗GitHub PoC★ 5
Exploit for the linux kernel vulnerability CVE-2017-5123
Insufficient data validation in waitid allowed an user to escape sandboxes on Linux.
23RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.