Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.957exploits catalogados

32.195CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8.182Nuclei 4.217Metasploit 3.462✓ só verificadosrecentes populares risco

4.217 exploits

Nucleimedium

Prismatic < 2.8 - Cross-Site Scripting

CVE-2021-24409—

Prismatic < 2.8 - Reflected Cross-Site Scripting (XSS)

18RISCO

abrir ↗

Nucleimedium

WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scripting

CVE-2021-24435—

Titan Framework <= 1.12.1 - Reflected Cross-Site Scripting (XSS)

18RISCO

abrir ↗

Nucleimedium

WordPress W3 Total Cache <2.1.4 - Cross-Site Scripting

CVE-2021-24436—

W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)

18RISCO

abrir ↗

Nucleicritical

Wordpress Polls Widget < 1.5.3 - SQL Injection

CVE-2021-24442—

Poll, Survey, Questionnaire and Voting system < 1.5.3 - Unauthenticated Blind SQL Injection

30RISCO

abrir ↗

Nucleimedium

WordPress W3 Total Cache <2.1.5 - Cross-Site Scripting

CVE-2021-24452—

W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)

18RISCO

abrir ↗

Nucleicritical

Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Remote File Inclusion/Server-Side Request Forgery

CVE-2021-24472—

Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Unauthenticated RFI and SSRF

30RISCO

abrir ↗

Nucleimedium

WordPress Post Grid <2.1.8 - Cross-Site Scripting

CVE-2021-24488—

Post Grid < 2.1.8 - Reflected Cross-Site Scripting (XSS)

43RISCO

abrir ↗

Nucleimedium

Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting

CVE-2021-24495—

Marmoset Viewer < 1.9.3 - Reflected Cross Site Scripting

18RISCO

abrir ↗

Nucleimedium

WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting

CVE-2021-24498—

Calendar Event Multi View < 1.4.01 - Unauthenticated Reflected Cross-Site Scripting (XSS)

18RISCO

abrir ↗

Nucleicritical

WordPress Workreap - Remote Code Execution

CVE-2021-24499—

Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

50RISCO

abrir ↗

Nucleimedium

WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting

CVE-2021-24510—

MF Gig Calendar < 1.2 - Reflected Cross-Site Scripting (XSS)

18RISCO

abrir ↗

Nucleimedium

ProfilePress < 3.1.11 - Cross-Site Scripting

CVE-2021-24522—

ProfilePress < 3.1.11 - Unauthenticated Cross-Site Scripting (XSS) in tabbed login/register widget

18RISCO

abrir ↗

Nucleicritical

Profile Builder < 3.4.9 - Improper Authentication

CVE-2021-24527—

Profile Builder < 3.4.9 - Admin Access via Password Reset

18RISCO

abrir ↗

Nucleihigh

WordPress Paytm Donation <=1.3.2 - Authenticated SQL Injection

CVE-2021-24554—

Paytm - Donation Plugin <= 1.3.2 - Authenticated (admin+) SQL Injection

18RISCO

abrir ↗

Nucleihigh

G Auto-Hyperlink <= 1.0.1 - SQL Injection

CVE-2021-24627—

G Auto-Hyperlink <= 1.0.1 - Admin+ SQL Injection

18RISCO

abrir ↗

Nucleihigh

Images to WebP < 1.9 - Authenticated Local File Inclusion

CVE-2021-24644—

Images to WebP < 1.9 - Authenticated Local File Inclusion

18RISCO

abrir ↗

Nucleihigh

Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login

CVE-2021-24647—

Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login

38RISCO

abrir ↗

Nucleimedium

Limit Login Attempts WordPress - Stored Cross-site Scripting

CVE-2021-24657—

Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site Scripting

18RISCO

abrir ↗

Nucleicritical

WordPress Podlove Podcast Publisher <3.5.6 - SQL Injection

CVE-2021-24666—

Podlove Podcast Publisher < 3.5.6 - Unauthenticated SQL Injection

18RISCO

abrir ↗

Nucleimedium

Duplicate Page WordPress - Stored Cross-Site Scripting

CVE-2021-24681—

Duplicate Page <= 4.4.2 - Admin+ Stored Cross-Site Scripting

18RISCO

abrir ↗

Nucleicritical

Pie Register < 3.7.1.6 - SQL Injection

CVE-2021-24731—

Pie Register < 3.7.1.6 - Unauthenticated SQL Injection

18RISCO

abrir ↗

Nucleimedium

WordPress Sassy Social Share Plugin <3.3.40 - Cross-Site Scripting

CVE-2021-24746—

Sassy Social Share < 3.3.40 - Reflected Cross-Site Scripting

18RISCO

abrir ↗

Nucleihigh

WordPress Visitor Statistics (Real Time Traffic) <4.8 -SQL Injection

CVE-2021-24750—

WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection

50RISCO

abrir ↗

Nucleicritical

WordPress Perfect Survey <1.5.2 - SQL Injection

CVE-2021-24762—

Perfect Survey < 1.5.2 - Unauthenticated SQL Injection

60RISCO

abrir ↗

Nucleihigh

Download Monitor < 4.4.5 - SQL Injection

CVE-2021-24786HIGH

Download Monitor < 4.4.5 - Admin+ SQL Injection

61RISCO

abrir ↗

Nucleihigh

Header Footer Code Manager < 1.1.14 - Admin+ SQL Injection

CVE-2021-24791—

Header Footer Code Manager < 1.1.14 - Admin+ SQL Injections

18RISCO

abrir ↗

Nucleicritical

WordPress Asgaros Forum <1.15.13 - SQL Injection

CVE-2021-24827—

Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection

23RISCO

abrir ↗

Nucleimedium

WordPress AnyComment <0.3.5 - Open Redirect

CVE-2021-24838—

AnyComment < 0.3.5 - Open Redirect

18RISCO

abrir ↗

Nucleicritical

WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection

CVE-2021-24849—

WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection

18RISCO

abrir ↗

Nucleihigh

WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection

CVE-2021-24862—

RegistrationMagic < 5.0.1.6 - Admin+ SQL Injection

60RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.