Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.957exploits catalogados

32.195CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8.182Nuclei 4.217Metasploit 3.462✓ só verificadosrecentes populares risco

4.217 exploits

Nucleicritical

SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization

CVE-2024-28986CRITICALsob ataque

SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability

95RISCO

abrir ↗

Nucleicritical

SolarWinds Web Help Desk - Hardcoded Credential

CVE-2024-28987CRITICALsob ataque

SolarWinds Web Help Desk Hardcoded Credential Vulnerability

100RISCO

abrir ↗

Nucleihigh

SolarWinds Serv-U - Directory Traversal

CVE-2024-28995HIGHsob ataque

SolarWinds Serv-U L Directory Transversal Vulnerability

100RISCO

abrir ↗

Nucleimedium

Memos 0.13.2 - Server-Side Request Forgery

CVE-2024-29028MEDIUM

memos vulnerable to an SSRF in /o/get/httpmeta

28RISCO

abrir ↗

Nucleimedium

Memos 0.13.2 - Cross-Site Scripting & SSRF

CVE-2024-29029MEDIUM

memos vulnerable to an SSRF in /o/get/image

28RISCO

abrir ↗

Nucleimedium

Memos 0.13.2 - Server-Side Request Forgery

CVE-2024-29030MEDIUM

memos vulnerable to an SSRF in /api/resource

28RISCO

abrir ↗

Nucleihigh

.NET Framework - Leaking ObjRefs via HTTP .NET Remoting

CVE-2024-29059HIGHsob ataque

.NET Framework Information Disclosure Vulnerability

100RISCO

abrir ↗

Nucleihigh

WordPress Tourfic Plugin <= 2.11.7 - Cross-Site Scripting

CVE-2024-29137HIGH

WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability

36RISCO

abrir ↗

Nucleimedium

WordPress Restrict User Access <= 2.5 - Cross-Site Scripting

CVE-2024-29138HIGH

WordPress Restrict User Access plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability

36RISCO

abrir ↗

Nucleihigh

GeoServer Demo Request Endpoint - Server Side Request Forgery

CVE-2024-29198HIGH

GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost

36RISCO

abrir ↗

Nucleicritical

Telesquare TLR-2005KSH - Remote Command Execution

CVE-2024-29269HIGH

An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the

56RISCO

abrir ↗

Nucleimedium

VvvebJs < 1.7.5 - Arbitrary File Upload

CVE-2024-29272MEDIUM

Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute

28RISCO

abrir ↗

Nucleihigh

MLflow < 2.11.3 - Path Traversal

CVE-2024-2928HIGH

Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow

41RISCO

abrir ↗

Nucleimedium

Unlimited Elements for Elementor <= 1.5.93 - Cross Site Scripting

CVE-2024-29792HIGH

WordPress Unlimited Elements for Elementor plugin <= 1.5.93 - Reflected Cross Site Scripting (XSS) vulnerability

36RISCO

abrir ↗

Nucleicritical

Mura/Masa CMS - SQL Injection

CVE-2024-32640CRITICAL

MasaCMS SQL Injection vulnerability

85RISCO

abrir ↗

Nucleicritical

Change Detection - Server Side Template Injection

CVE-2024-32651CRITICAL

Server Side Template Injection in Jinja2 allows Remote Command Execution

85RISCO

abrir ↗

Nucleicritical

WP-Recall <= 16.26.5 - SQL Injection

CVE-2024-32709CRITICAL

WordPress WP-Recall plugin <= 16.26.5 - SQL Injection vulnerability

43RISCO

abrir ↗

Nucleicritical

D-Link Network Attached Storage - Backdoor Account

CVE-2024-3272CRITICALsob ataque

D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials

100RISCO

abrir ↗

Nucleicritical

D-Link Network Attached Storage - Command Injection and Backdoor Account

CVE-2024-3273HIGHsob ataque

D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection

100RISCO

abrir ↗

Nucleicritical

CyberPower - Missing Authentication

CVE-2024-32735CRITICAL

CyberPower PowerPanel Enterprise Missing Authentication

43RISCO

abrir ↗

Nucleihigh

CyberPower < v2.8.3 - SQL Injection

CVE-2024-32736HIGH

CyberPower PowerPanel Enterprise SQL Injection

36RISCO

abrir ↗

Nucleihigh

CyberPower - SQL Injection

CVE-2024-32737HIGH

CyberPower PowerPanel Enterprise SQL Injection

36RISCO

abrir ↗

Nucleihigh

CyberPower - SQL Injection

CVE-2024-32738HIGH

CyberPower PowerPanel Enterprise SQL Injection

36RISCO

abrir ↗

Nucleihigh

CyberPower < v2.8.3 - SQL Injection

CVE-2024-32739HIGH

CyberPower PowerPanel Enterprise SQL Injection

36RISCO

abrir ↗

Nucleimedium

D-LINK DNS-320L,DNS-320LW and DNS-327L - Information Disclosure

CVE-2024-3274MEDIUM

D-Link DNS-320L/DNS-320LW/DNS-327L HTTP GET Request info.cgi information disclosure

40RISCO

abrir ↗

Nucleimedium

Simply Static - Information Disclosure

CVE-2024-32825HIGH

WordPress Simply Static plugin <= 3.1.3 - Sensitive Data Exposure via Log File vulnerability

36RISCO

abrir ↗

Nucleimedium

iTop Hub Connector - Information Disclosure

CVE-2024-32870MEDIUM

iTop hub connector Information disclosure

28RISCO

abrir ↗

Nucleicritical

Lobe Chat <= v0.150.5 - Server-Side Request Forgery

CVE-2024-32964CRITICAL

lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

55RISCO

abrir ↗

Nucleicritical

Delmia Apriso - Pre-Authentication Unsafe .NET Object Deserialization

CVE-2024-3300CRITICAL

Pre-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024

43RISCO

abrir ↗

Nucleimedium

D-LINK DIR-845L bsc_sms_inbox.php file - Information Disclosure

CVE-2024-33113MEDIUM

D-LINK DIR-845L <=v1.01KRb03 is vulnerable to Information disclosurey via bsc_sms_inbox.php.

28RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.