Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
71.957exploits catalogados
32.195CVEs com exploração pública
1.932testados em laboratório
TodosExploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8.182Nuclei 4.217Metasploit 3.462✓ só verificadosrecentespopularesrisco
4.217 exploits
Nucleimedium
Grafana - Exposes DingDing API Keys
Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not p
28RISCO
abrir ↗Nucleicritical
Shenzhen Aitemi M300 Wi-Fi Repeater – Unauthenticated Remote Command Execution via `time` Parameter
Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via Time Parameter
75RISCO
abrir ↗Nucleicritical
Langflow AI <= 1.6.9 - CORS Misconfiguration
Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE
100RISCO
abrir ↗Nucleicritical
Monsta FTP <= 2.11.2 - Unauthenticated Remote Code Execution
Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload
85RISCO
abrir ↗Nucleicritical
SawtoothSoftware Lighthouse Studio < 9.16.14 - Pre-Auth Remote Code Execution
Sawtooth Software Lighthouse Studio < 9.16.14 Pre-Authentication RCE
75RISCO
abrir ↗Nucleihigh
Sitecore Experience Manager (XM) and Experience Platform (XP) - Hardcoded Credentials
Sitecore XM and XP Hardcoded Credentials
48RISCO
abrir ↗Nucleimedium
Ocean Extra <= 2.4.6 - Unauthenticated Shortcode Execution
Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution
28RISCO
abrir ↗Nucleihigh
Contact Form 7 Drag and Drop Multiple File Upload - Arbitrary File Upload
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks
56RISCO
abrir ↗Nucleicritical
WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation
Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeover
63RISCO
abrir ↗Nucleicritical
Dell UnityVSA < 5.5 - Remote Command Injection
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
68RISCO
abrir ↗Nucleihigh
Eveo URVE Web Manager - Server-Side Request Forgery
An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /_internal/redirect.php allows for Server-Side
36RISCO
abrir ↗Nucleicritical
HPE OneView - Remote Code Execution
A remote code execution issue exists in HPE OneView.
100RISCO
abrir ↗Nucleihigh
MeteoBridge <= 6.1 - Remote Code Execution
Arbitrary Command Injection in Smartbedded MeteoBridge
88RISCO
abrir ↗Nucleicritical
Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection
Unauthenticated Arbitrary Command Injection in Evertz SDVN
65RISCO
abrir ↗Nucleihigh
SolarWinds Web Help Desk < 12.8.8 Hotfix 1 (HF1) - Security Control Bypass
SolarWinds Web Help Desk Security Control Bypass Vulnerability
100RISCO
abrir ↗Nucleicritical
SolarWinds Web Help Desk < 2026.1 - Unauthenticated JNDI Injection RCE
SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
95RISCO
abrir ↗Nucleicritical
SolarWinds Web Help Desk - Authentication Bypass
SolarWinds Web Help Desk Authentication Bypass Vulnerability
75RISCO
abrir ↗Nucleicritical
SolarWinds Web Help Desk - Authentication Bypass
SolarWinds Web Help Desk Authentication Bypass Vulnerability
75RISCO
abrir ↗Nucleimedium
IceWarp Mail Server ≤11.4.0 - Open Redirect
Open redirection vulnerability in IceWarp Mail Server
28RISCO
abrir ↗Nucleimedium
Wangshen SecGate 3600 Path Traversal Vulnerability
Wangshen SecGate 3600 g=log_export_file path traversal
28RISCO
abrir ↗Nucleihigh
Grafana - XSS / Open Redirect / SSRF via Client Path Traversal
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
78RISCO
abrir ↗Nucleimedium
Spring Framework - Path Traversal
CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers
28RISCO
abrir ↗Nucleicritical
Spring Cloud Gateway Server Webflux - Broken Access Control
Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux
63RISCO
abrir ↗Nucleimedium
Ricoh Web Image Monitor - Reflected XSS
Reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implem
28RISCO
abrir ↗Nucleicritical
RevPi Webstatus <= v2.4.5 - Authentication Bypass
RevPi Webstatus application is vulnerable to an authentication bypass
75RISCO
abrir ↗Nucleihigh
Casdoor - Authorization Bypass
Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization
28RISCO
abrir ↗Nucleimedium
Stop User Enumeration WordPress plugin - Authentication Bypass
Stop User Enumeration < 1.7.3 - Protection Bypass
28RISCO
abrir ↗Nucleicritical
Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
68RISCO
abrir ↗Nucleicritical
Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation
Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation
63RISCO
abrir ↗Nucleicritical
Ads Pro Plugin <= 4.89 - Local File Inclusion
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion
41RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.