Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.957exploits catalogados

32.195CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8.182Nuclei 4.217Metasploit 3.462✓ só verificadosrecentes populares risco

4.217 exploits

Nucleicritical

Versa Concerto Actuator Endpoint - Authentication Bypass

CVE-2025-34026CRITICALsob ataque

Versa Concerto Actuator Authentication Bypass Information Leak

100RISCO

abrir ↗

Nucleicritical

Versa Concerto API Path Based - Authentication Bypass

CVE-2025-34027CRITICAL

Versa Concerto Authentication Bypass File Write Remote Code Execution

75RISCO

abrir ↗

Nucleicritical

Commvault - SSRF via /commandcenter/deployWebpackage.do

CVE-2025-34028CRITICALsob ataque

Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal

100RISCO

abrir ↗

Nucleicritical

sar2html <=3.2.2 Plot Parameter - Remote Code Execution

CVE-2025-34030CRITICAL

sar2html OS Command Injection

75RISCO

abrir ↗

Nucleihigh

Moodle Jmol Filter 6.1 - Local File Inclusion

CVE-2025-34031HIGH

Moodle LMS Jmol Plugin Path Traversal

36RISCO

abrir ↗

Nucleimedium

Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting

CVE-2025-34032MEDIUM

Moodle LMS Jmol Plugin Cross-site Scripting (XSS)

28RISCO

abrir ↗

Nucleicritical

EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution

CVE-2025-34035CRITICAL

EnGenius EnShare IoT Gigabit Cloud Service Command Injection

68RISCO

abrir ↗

Nucleihigh

Fanwei e-cology - SQL Injection

CVE-2025-34038HIGH

Weaver E-cology SQL Injection

36RISCO

abrir ↗

Nucleicritical

Zhiyuan OA Platform - Arbitrary File Upload

CVE-2025-34040CRITICAL

Seeyon Zhiyuan OA System Path Traversal File Upload

68RISCO

abrir ↗

Nucleihigh

WeiPHP 5.0 - Path Traversal

CVE-2025-34045HIGH

WeiPHP Path Traversal Arbitrary File Read

36RISCO

abrir ↗

Nucleicritical

Maltrail <=0.54 Username Parameter - Remote Command Execution

CVE-2025-34073CRITICAL

stamparm/maltrail <=0.54 Remote Command Execution

63RISCO

abrir ↗

Nucleicritical

WordPress Pie Register <= 3.7.1.4 - Authentication Bypass

CVE-2025-34077CRITICAL

WordPress Pie Register Plugin ≤ 3.7.1.4 Authentication Bypass RCE

63RISCO

abrir ↗

Nucleicritical

WordPress Simple File List <=4.2.2 - Remote Code Execution

CVE-2025-34085—

35RISCO

abrir ↗

Nucleimedium

ETQ Reliance - Reflected XSS via SQLConverterServlet

CVE-2025-34141MEDIUM

ETQ Reliance CG < SE.2025.1 Reflected XSS in `SQLConverterServlet`

28RISCO

abrir ↗

Nucleicritical

ETQ Reliance - Authentication Bypass via Trailing Space

CVE-2025-34143CRITICAL

ETQ Reliance CG Authentication Bypass via Trailing Space RCE

48RISCO

abrir ↗

Nucleimedium

Grafana - Exposes DingDing API Keys

CVE-2025-3415MEDIUM

Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not p

28RISCO

abrir ↗

Nucleicritical

Shenzhen Aitemi M300 Wi-Fi Repeater – Unauthenticated Remote Command Execution via `time` Parameter

CVE-2025-34152CRITICAL

Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via Time Parameter

75RISCO

abrir ↗

Nucleicritical

Langflow AI <= 1.6.9 - CORS Misconfiguration

CVE-2025-34291CRITICALsob ataque

Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE

100RISCO

abrir ↗

Nucleicritical

Monsta FTP <= 2.11.2 - Unauthenticated Remote Code Execution

CVE-2025-34299CRITICAL

Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload

85RISCO

abrir ↗

Nucleicritical

SawtoothSoftware Lighthouse Studio < 9.16.14 - Pre-Auth Remote Code Execution

CVE-2025-34300CRITICAL

Sawtooth Software Lighthouse Studio < 9.16.14 Pre-Authentication RCE

75RISCO

abrir ↗

Nucleihigh

Sitecore Experience Manager (XM) and Experience Platform (XP) - Hardcoded Credentials

CVE-2025-34509HIGH

Sitecore XM and XP Hardcoded Credentials

48RISCO

abrir ↗

Nucleimedium

Ocean Extra <= 2.4.6 - Unauthenticated Shortcode Execution

CVE-2025-3472MEDIUM

Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution

28RISCO

abrir ↗

Nucleihigh

Contact Form 7 Drag and Drop Multiple File Upload - Arbitrary File Upload

CVE-2025-3515HIGH

Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks

56RISCO

abrir ↗

Nucleicritical

WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation

CVE-2025-3605CRITICAL

Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeover

63RISCO

abrir ↗

Nucleicritical

Dell UnityVSA < 5.5 - Remote Command Injection

CVE-2025-36604HIGH

Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('

68RISCO

abrir ↗

Nucleihigh

Eveo URVE Web Manager - Server-Side Request Forgery

CVE-2025-36845HIGH

An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /_internal/redirect.php allows for Server-Side

36RISCO

abrir ↗

Nucleicritical

HPE OneView - Remote Code Execution

CVE-2025-37164CRITICALsob ataque

A remote code execution issue exists in HPE OneView.

100RISCO

abrir ↗

Nucleihigh

Personal Weather Station Dashboard 12 - Directory Traversal

CVE-2025-47423MEDIUM

Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ direct

28RISCO

abrir ↗

Nucleihigh

WordPress Eventin (Themewinter) ≤ 4.0.26 - Arbitrary File Download

CVE-2025-47445HIGH

WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability

36RISCO

abrir ↗

Nucleicritical

Eventin <= 4.0.26 - Privilege Escalation

CVE-2025-47539CRITICAL

WordPress Eventin plugin <= 4.0.26 - Privilege Escalation Vulnerability

75RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.