Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
86.990exploits catalogados
40.451CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.043VulnCheck XDB 10.121Nuclei 4.561Metasploit 3.537✓ só verificadosrecentespopularesrisco
86.990 exploits
GitHub PoC
homjxi0e/CVE-2017-7472
The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumptio
23RISCO
abrir ↗Exploit-DB
IDERA Uptime Monitor 7.8 - Multiple Vulnerabilities
IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatifGadget/getxenmetrics.php via the
23RISCO
abrir ↗Exploit-DB
Net Monitor for Employees Pro < 5.3.4 - Unquoted Service Path Privilege Escalation
Net Monitor for Employees Pro through 5.3.4 has an unquoted service path, which allows a Security Feature Bypass of its
23RISCO
abrir ↗GitHub PoC★ 6
own implementation of the CVE-2017-1000367 sudo privilege escalation vulnerability in python
Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_
23RISCO
abrir ↗GitHub PoC★ 1
Struts-RCE CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
VMware Workstation 12 Pro - Denial of Service
VMware Workstation Pro/Player contains a NULL pointer dereference vulnerability that exists in the vstor2 driver. Succes
23RISCO
abrir ↗GitHub PoC
homjxi0e/CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISCO
abrir ↗VulnCheck XDB
initial-access
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Linux Kernel - 'ping' Local Denial of Service
The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a certain lock a
23RISCO
abrir ↗GitHub PoC
smancke/CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Linux Kernel < 4.10.13 - 'keyctl_set_reqkey_keyring' Local Denial of Service
The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumptio
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
PuTTY < 0.68 - 'ssh_agent_channel_data' Integer Overflow Heap Corruption
The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large
28RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Artifex MuPDF - Null Pointer Dereference
An issue was discovered in Artifex MuPDF before 1912de5f08e90af1d9d0a9791f58ba3afdb9d465. The pdf_run_xobject function i
28RISCO
abrir ↗GitHub PoC★ 85
Motorola Untethered Jailbreak: Exploiting CVE-2016-10277 for Secure Boot and Device Locking bypass
An elevation of privilege vulnerability in the Motorola bootloader could enable a local malicious application to execute
23RISCO
abrir ↗Exploit-DB
Peplink Balance Routers 7.0.0-build1904 - SQL Injection / Cross-Site Scripting / Information Disclosure
CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_
23RISCO
abrir ↗Exploit-DB
Peplink Balance Routers 7.0.0-build1904 - SQL Injection / Cross-Site Scripting / Information Disclosure
SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw
50RISCO
abrir ↗Exploit-DB
Peplink Balance Routers 7.0.0-build1904 - SQL Injection / Cross-Site Scripting / Information Disclosure
Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-
23RISCO
abrir ↗Exploit-DB
Apple Safari 10.1 - Spread Operator Integer Overflow Remote Code Execution
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS
28RISCO
abrir ↗Exploit-DB
Peplink Balance Routers 7.0.0-build1904 - SQL Injection / Cross-Site Scripting / Information Disclosure
XSS via orig_url exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_38
23RISCO
abrir ↗Exploit-DB
Apache Struts - REST Plugin With Dynamic Method Invocation Remote Code Execution
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, a
60RISCO
abrir ↗Exploit-DB
Peplink Balance Routers 7.0.0-build1904 - SQL Injection / Cross-Site Scripting / Information Disclosure
Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b30
23RISCO
abrir ↗Exploit-DB
Peplink Balance Routers 7.0.0-build1904 - SQL Injection / Cross-Site Scripting / Information Disclosure
XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380h
23RISCO
abrir ↗Exploit-DB
Peplink Balance Routers 7.0.0-build1904 - SQL Injection / Cross-Site Scripting / Information Disclosure
Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before f
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Wireshark 2.2.6 - IPv6 Dissector Denial of Service
In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. This was addressed in epan/dissectors/packet-ipv6.c by vali
28RISCO
abrir ↗Exploit-DB
BIND 9.10.5 - Unquoted Service Path Privilege Escalation
Windows service and uninstall paths are not quoted when BIND is installed
41RISCO
abrir ↗Exploit-DB
Subsonic 6.1.1 - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target u
23RISCO
abrir ↗Exploit-DB
Subsonic 6.1.1 - Server-Side Request Forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attacke
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Subsonic 6.1.1 - Cross-Site Request Forgery / Cross-Site Scripting
Cross-site request forgery (CSRF) vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows remote atta
28RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Wireshark 2.2.0 < 2.2.12 - ROS Dissector Denial of Service
In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. This was addressed in epan/d
28RISCO
abrir ↗GitHub PoC★ 259
Remote root exploit for the SAMBA CVE-2017-7494 vulnerability
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.