Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

86.899exploits catalogados
40.392CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.190Exploit-DB 24.488GitHub PoC 18.020VulnCheck XDB 10.108Nuclei 4.556Metasploit 3.537✓ só verificadosrecentespopularesrisco
86.899 exploits
Exploit-DB✓ VexDay Proof
Microsoft Windows 10 - WLDP/MSHTML CLSID UMCI Bypass
CVE-2017-11823—doswindows17 out 2017
The Microsoft Device Guard on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a security
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Tomcat - Remote Code Execution via JSP Upload Bypass (Metasploit)
CVE-2017-12617HIGHsob ataqueremotejava17 out 2017
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
100RISCO
abrir ↗
Exploit-DB
OpenText Documentum Content Server - 'dmr_content' Privilege Escalation
CVE-2017-15013—webappsmultiple17 out 2017
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design ga
23RISCO
abrir ↗
Exploit-DB
OpenText Documentum Content Server - Privilege Escalation
CVE-2017-15276—webappsmultiple17 out 2017
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design ga
23RISCO
abrir ↗
Exploit-DB
Ikraus Anti Virus 2.16.7 - Remote Code Execution
CVE-2017-15643—remotewindows16 out 2017
An active network attacker (MiTM) can achieve remote code execution on a machine that runs IKARUS Anti Virus 2.16.7. IKA
23RISCO
abrir ↗
Exploit-DB
3CX Phone System 15.5.3554.1 - Directory Traversal
CVE-2017-15359—webappslinux16 out 2017
In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory t
23RISCO
abrir ↗
Exploit-DB
Linux Kernel < 3.16.39 (Debian 8 x64) - 'inotfiy' Local Privilege Escalation
CVE-2017-7533—locallinux_x86-6416 out 2017
Race condition in the fsnotify implementation in the Linux kernel through 4.12.4 allows local users to gain privileges o
23RISCO
abrir ↗
Exploit-DB
Webmin 1.850 - Multiple Vulnerabilities
CVE-2017-15644—webappscgi15 out 2017
SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/h
23RISCO
abrir ↗
Exploit-DB
Webmin 1.850 - Multiple Vulnerabilities
CVE-2017-15645—webappscgi15 out 2017
CSRF exists in Webmin 1.850. By sending a GET request to at/create_job.cgi containing dir=/&cmd= in the URI, an attacker
23RISCO
abrir ↗
Exploit-DB
Webmin 1.850 - Multiple Vulnerabilities
CVE-2017-15646—webappscgi15 out 2017
Webmin before 1.860 has XSS with resultant remote code execution. Under the 'Others/File Manager' menu, there is a 'Down
23RISCO
abrir ↗
Exploit-DB
Logitech Media Server - Cross-Site Scripting
CVE-2017-15687—webappsmultiple14 out 2017
DOM Based Cross Site Scripting (XSS) exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1
23RISCO
abrir ↗
Exploit-DB
phpMyFAQ 2.9.8 - Cross-Site Scripting (2)
CVE-2017-14619—webappsphp13 out 2017
Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web scrip
23RISCO
abrir ↗
Exploit-DB
AlienVault Unified Security Management (USM) 5.4.2 - Cross-Site Request Forgery
CVE-2017-14956—webappsphp13 out 2017
AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the "/
23RISCO
abrir ↗
Exploit-DB
FiberHome - Directory Traversal
CVE-2017-15647—webappslinux13 out 2017
On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a cra
43RISCO
abrir ↗
Exploit-DB
OctoberCMS 1.0.425 (Build 425) - Cross-Site Scripting
CVE-2017-15284—webappsphp12 out 2017
Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG fil
23RISCO
abrir ↗
Exploit-DB
Dreambox Plugin BouquetEditor - Cross-Site Scripting
CVE-2017-15287—webappshardware12 out 2017
There is XSS in the BouquetEditor WebPlugin for Dream Multimedia Dreambox devices, as demonstrated by the "Name des Bouq
38RISCO
abrir ↗
Exploit-DB
TP-Link TL-MR3220 - Cross-Site Scripting
CVE-2017-15291—webappshardware12 out 2017
Cross-site scripting (XSS) vulnerability in the Wireless MAC Filtering page in TP-LINK TL-MR3220 wireless routers allows
23RISCO
abrir ↗
GitHub PoC★ 1
Ready to use, weaponized dirtycow (CVE-2016-5195)
CVE-2016-5195HIGHsob ataque11 out 2017
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISCO
abrir ↗
Exploit-DB
Trend Micro OfficeScan 11.0/XG (12.0) - Remote Code Execution (Metasploit)
CVE-2017-11394—webappsphp11 out 2017
Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitr
50RISCO
abrir ↗
Exploit-DB
ASX to MP3 3.1.3.7 - '.m3u' Local Buffer Overflow
CVE-2017-15221—localwindows11 out 2017
ASX to MP3 converter 3.1.3.7.2010.11.05 has a buffer overflow via a crafted M3U file, a related issue to CVE-2009-1324.
23RISCO
abrir ↗
GitHub PoC★ 1
Exploit Safari CVE-2017-7089
CVE-2017-7089—11 out 2017
An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud befor
23RISCO
abrir ↗
GitHub PoC
CVE-2010-3332 Oracle Padding Vulnerability in Microsoft ASP.NET
CVE-2010-3332—11 out 2017
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Intern
35RISCO
abrir ↗
GitHub PoC★ 1
Apache HTTP Server 2.4.23 vulnerability study (CVE-2016-8740)
CVE-2016-8740—11 out 2017
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2
45RISCO
abrir ↗
Exploit-DB
binutils 2.29.51.20170921 - 'read_1_byte' Heap Buffer Overflow
CVE-2017-14939—doslinux10 out 2017
decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.
23RISCO
abrir ↗
GitHub PoC★ 138
Blueborne CVE-2017-0781 Android heap overflow vulnerability
CVE-2017-0781—09 out 2017
A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1
28RISCO
abrir ↗
Exploit-DB
PHP Melody 2.7.3 - Multiple Vulnerabilities
CVE-2017-15579—webappsphp09 out 2017
In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via an aa_pages_per_page cookie in a playlist action to watch.
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (2)
CVE-2017-12617HIGHsob ataquewebappsjsp09 out 2017
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
100RISCO
abrir ↗
Exploit-DB
VX Search Enterprise 10.1.12 - Remote Buffer Overflow
CVE-2017-15220—remotewindows09 out 2017
Flexense VX Search Enterprise 10.1.12 is vulnerable to a buffer overflow via an empty POST request to a long URI beginni
23RISCO
abrir ↗
Exploit-DB
PHP Melody 2.7.3 - Multiple Vulnerabilities
CVE-2017-15578—webappsphp09 out 2017
In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via the image parameter to admin/edit_category.php.
23RISCO
abrir ↗
Metasploit300
Easy Chat Server User Registeration Buffer Overflow (SEH)
CVE-2017-9544—09 out 2017
There is a remote stack-based buffer overflow (SEH) in register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1
23RISCO
abrir ↗
← anteriorpágina 1077 / 2.897próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.