Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
79.980exploits catalogados
36.899CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.476Referência 23.400GitHub PoC 15.250VulnCheck XDB 8.959Nuclei 4.393Metasploit 3.502✓ só verificadosrecentespopularesrisco
24.476 exploits
Exploit-DB
RAVPower 2.000.056 - Root Remote Code Execution
An issue was discovered in the HTTP Server in RAVPower Filehub 2.000.056. Due to an unrestricted upload feature and a pa
28RISCO
abrir ↗Exploit-DB
Telerik UI for ASP.NET AJAX 2012.3.1308 < 2017.1.118 - Encryption Keys Disclosure
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not
100RISCO
abrir ↗Exploit-DB
Zechat 1.5 - SQL Injection
SQL Injection exists in Facebook Style Php Ajax Chat Zechat 1.5 via the login.php User field.
23RISCO
abrir ↗Exploit-DB
Affiligator 2.1.0 - SQL Injection
SQL Injection exists in Affiligator Affiliate Webshop Management System 2.1.0 via a search/?q=&price_type=range&price= r
23RISCO
abrir ↗Exploit-DB
Photography CMS 1.0 - Cross-Site Request Forgery (Add Admin)
Cross Site Request Forgery (CSRF) exists in Photography CMS 1.0 via clients/resources/ajax/ajax_new_admin.php, as demons
23RISCO
abrir ↗Exploit-DB
Easy Car Script 2014 - SQL Injection
SQL Injection exists in Easy Car Script 2014 via the s_order or s_row parameter to site_search.php.
23RISCO
abrir ↗Exploit-DB
Flexible Poll 1.2 - SQL Injection
SQL Injection exists in Flexible Poll 1.2 via the id parameter to mobile_preview.php or index.php.
28RISCO
abrir ↗Exploit-DB
RAVPower 2.000.056 - Memory Disclosure
RAVPower FileHub 2.000.056 allows remote users to steal sensitive information via a crafted HTTP request.
28RISCO
abrir ↗Exploit-DB
RSVP Invitation Online 1.0 - Cross-Site Request Forgery (Update Admin)
Cross Site Request Forgery (CSRF) exists in RSVP Invitation Online 1.0 via function/account.php, as demonstrated by modi
23RISCO
abrir ↗Exploit-DB
Tumder 2.1 - SQL Injection
SQL Injection exists in the Tumder (An Arcade Games Platform) 2.1 component for Joomla! via the PATH_INFO to the categor
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
HP Connected Backup 8.6/8.8.6 - Local Privilege Escalation
A potential security vulnerability has been identified in HPE Connected Backup versions 8.6 and 8.8.6. The vulnerability
23RISCO
abrir ↗Exploit-DB
LiveCRM SaaS Cloud 1.0 - SQL Injection
SQL Injection exists in the LiveCRM SaaS Cloud 1.0 component for Joomla! via an r=site/login&company_id= request.
28RISCO
abrir ↗Exploit-DB
Wchat 1.5 - SQL Injection
SQL Injection exists in Wchat Fully Responsive PHP AJAX Chat Script 1.5 via the login.php User field.
28RISCO
abrir ↗Exploit-DB
Quickad 4.0 - SQL Injection
SQL Injection exists in Classified Ads CMS Quickad 4.0 via the keywords, placeid, cat, or subcat parameter to the listin
28RISCO
abrir ↗Exploit-DB
AsusWRT Router < 3.0.0.4.380.7743 - LAN Remote Code Execution
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpn
60RISCO
abrir ↗Exploit-DB
AsusWRT Router < 3.0.0.4.380.7743 - LAN Remote Code Execution
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, pro
60RISCO
abrir ↗Exploit-DB
OTRS 5.0.x/6.0.x - Remote Command Execution (1)
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.2
28RISCO
abrir ↗Exploit-DB
Shopware 5.2.5/5.3 - Cross-Site Scripting
Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management
23RISCO
abrir ↗Exploit-DB
PHPFreeChat 1.7 - Denial of Service
phpFreeChat 1.7 and earlier allows remote attackers to cause a denial of service by sending a large number of connect co
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Oracle JDeveloper 11.1.x/12.x - Directory Traversal
Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Deployment). Supported versi
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
macOS 10.13 (17A365) - Kernel Memory Disclosure due to Lack of Bounds Checking in 'AppleIntelCapriController::getDisplayPipeCapability'
An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Intel Graph
23RISCO
abrir ↗Exploit-DB
Smiths Medical Medfusion 4000 - 'DHCP' Denial of Service
A Classic Buffer Overflow issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version
28RISCO
abrir ↗Exploit-DB
Primefaces 5.x - Remote Code Execution (Metasploit)
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra JIT - Incorrect Bounds Calculation
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitra
45RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra JIT - Out-of-Bounds Write
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitra
45RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra - Incorrect Scope Handling
Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due t
35RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra - 'AsmJSByteCodeGenerator::EmitCall' Out-of-Bounds Read
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtai
35RISCO
abrir ↗Exploit-DB
Master IP CAM 01 - Multiple Vulnerabilities
MASTER IPCAMERA01 3.3.4.2103 devices allow Unauthenticated Configuration Download and Upload, as demonstrated by restore
28RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra - Deferred Parsing Makes Wrong Scopes (2)
Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due t
35RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra - 'JavascriptGeneratorFunction::GetPropertyBuiltIns' Type Confusion
ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain t
35RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.