Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

86.899exploits catalogados
40.392CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.190Exploit-DB 24.488GitHub PoC 18.020VulnCheck XDB 10.108Nuclei 4.556Metasploit 3.537✓ só verificadosrecentespopularesrisco
86.899 exploits
Exploit-DB
tPanel 2009 - Authentication Bypass
CVE-2017-15974—webappsphp30 out 2017
tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php.
23RISCO
abrir ↗
GitHub PoC
This is the Apache Struts CVE-2017-5638 struts 2 vulnerability. The same CVE that resulted in the equifax database breach.
CVE-2017-5638CRITICALsob ataqueransomware30 out 2017
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISCO
abrir ↗
Exploit-DB
MyMagazine 1.0 - 'id' SQL Injection
CVE-2017-15983—webappsphp30 out 2017
MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing
23RISCO
abrir ↗
Exploit-DB
Article Directory Script 3.0 - 'id' SQL Injection
CVE-2017-15960—webappsphp30 out 2017
Article Directory Script 3.0 allows SQL Injection via the id parameter to author.php or category.php.
23RISCO
abrir ↗
Exploit-DB
Basic B2B Script - SQL Injection
CVE-2017-15985—webappsphp30 out 2017
Basic B2B Script allows SQL Injection via the product_view1.php pid or id parameter.
23RISCO
abrir ↗
Exploit-DB
Zomato Clone Script - 'resid' SQL Injection
CVE-2017-15993—webappsphp30 out 2017
Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter.
23RISCO
abrir ↗
Exploit-DB
iTech Gigs Script 1.21 - SQL Injection
CVE-2017-15963—webappsphp30 out 2017
iTech Gigs Script 1.21 allows SQL Injection via the browse-scategory.php sc parameter or the service-provider.php ser pa
23RISCO
abrir ↗
Exploit-DB
iProject Management System 1.0 - 'ID' SQL Injection
CVE-2017-15961—webappsphp30 out 2017
iProject Management System 1.0 allows SQL Injection via the ID parameter to index.php.
23RISCO
abrir ↗
Exploit-DB
D-Park Pro 1.0 - SQL Injection
CVE-2017-15958—webappsphp30 out 2017
D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.
23RISCO
abrir ↗
Exploit-DB
AROX School ERP PHP Script - 'id' SQL Injection
CVE-2017-15978—webappsphp30 out 2017
AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter.
23RISCO
abrir ↗
Exploit-DB
Job Board Script - 'nice_theme' SQL Injection
CVE-2017-15964—webappsphp30 out 2017
Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI.
23RISCO
abrir ↗
Exploit-DB
SoftDatepro Dating Social Network 1.3 - SQL Injection
CVE-2017-15972—webappsphp30 out 2017
SoftDatepro Dating Social Network 1.3 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php
23RISCO
abrir ↗
Exploit-DB
Adult Script Pro 2.2.4 - SQL Injection
CVE-2017-15959—webappsphp30 out 2017
Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-200
23RISCO
abrir ↗
Exploit-DB
Ingenious 2.3.0 - Arbitrary File Upload
CVE-2017-15957—webappsphp30 out 2017
my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.
23RISCO
abrir ↗
Exploit-DB
CPA Lead Reward Script - SQL Injection
CVE-2017-15986—webappsphp30 out 2017
CPA Lead Reward Script allows SQL Injection via the username parameter.
23RISCO
abrir ↗
Exploit-DB
iStock Management System 1.0 - Arbitrary File Upload
CVE-2017-15962—webappsphp30 out 2017
iStock Management System 1.0 allows Arbitrary File Upload via user/profile.
23RISCO
abrir ↗
Metasploit600
Xplico Remote Code Execution
CVE-2017-16666—29 out 2017
Xplico before 1.2.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the name
60RISCO
abrir ↗
Exploit-DB
PHP Melody 2.6.1 - SQL Injection
CVE-2017-15081—webappsphp28 out 2017
In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.
23RISCO
abrir ↗
GitHub PoC★ 2
This exploit was written to study some concepts, enjoy!
CVE-2010-4221—28 out 2017
Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow rem
60RISCO
abrir ↗
Exploit-DB
PHPMyFAQ 2.9.8 - Cross-Site Scripting (3)
CVE-2017-15727—webappsphp28 out 2017
In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment.
23RISCO
abrir ↗
Exploit-DB
phpMyFAQ 2.9.8 - Cross-Site Request Forgery
CVE-2017-15730—webappsphp27 out 2017
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.
23RISCO
abrir ↗
Exploit-DB
HitmanPro 3.7.15 Build 281 - Kernel Pool Overflow
CVE-2017-6008—localwindows26 out 2017
A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in
23RISCO
abrir ↗
Exploit-DB
Watchdog Development Anti-Malware / Online Security Pro - NULL Pointer Dereference
CVE-2017-15921—doswindows26 out 2017
In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointer
23RISCO
abrir ↗
Exploit-DB
Watchdog Development Anti-Malware / Online Security Pro - NULL Pointer Dereference
CVE-2017-15920—doswindows26 out 2017
In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointer
23RISCO
abrir ↗
Exploit-DB
PHPMailer < 5.2.21 - Local File Disclosure
CVE-2017-5223—webappsphp25 out 2017
An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML docume
23RISCO
abrir ↗
Exploit-DB
KeystoneJS 4.0.0-beta.5 - Cross-Site Scripting
CVE-2017-15878—webappsnodejs25 out 2017
A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-be
23RISCO
abrir ↗
Exploit-DB
KeystoneJS 4.0.0-beta.5 - CSV Excel Macro Injection
CVE-2017-15879—webappsnodejs25 out 2017
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCS
23RISCO
abrir ↗
GitHub PoC★ 2
dewankpant/CVE-2017-16567
CVE-2017-16567—24 out 2017
Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. T
23RISCO
abrir ↗
Exploit-DB
Mura CMS < 6.2 - Server-Side Request Forgery / XML External Entity Injection
CVE-2017-15639—webappscfm24 out 2017
tasks/feed/readRSS.cfm in Mura CMS before 6.2 allows attackers to bypass intended access restrictions by leveraging the
23RISCO
abrir ↗
Exploit-DB
K7 Total Security 15.1.0.305 - Device Driver Arbitrary Memory Read
CVE-2017-18019—doswindows23 out 2017
In K7 Total Security before 15.1.0.305, user-controlled input to the K7Sentry device is not sufficiently sanitized: the
23RISCO
abrir ↗
← anteriorpágina 1075 / 2.897próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.