Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
86.991exploits catalogados
40.452CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4.561Metasploit 3.537✓ só verificadosrecentespopularesrisco
86.991 exploits
GitHub PoC
Dockerfile for testing CVE-2014-0160 Heartbleed exploitation.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
The World Browser 3.0 Final - Remote Code Execution
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISCO
abrir ↗Metasploit300
Joomla com_contenthistory Error-Based SQL Injection
SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via un
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Zpanel - Remote Code Execution (Metasploit)
ZPanel through 10.1.0 has Remote Command Execution
43RISCO
abrir ↗Exploit-DB✓ VexDay Proof
HTML Compiler - Remote Code Execution
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Adobe Flash - 'IExternalizable.writeExternal' Type Confusion
Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535
83RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Nibbleblog 4.0.3 - Arbitrary File Upload (Metasploit)
Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to
50RISCO
abrir ↗Exploit-DB
Belkin N150 Router 1.00.08/1.00.09 - Directory Traversal
Absolute path traversal vulnerability in the webproc cgi module on the Belkin N150 F9K1009 v1 router with firmware befor
50RISCO
abrir ↗Metasploit0
Safari User-Assisted Applescript Exec Attack
Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement f
50RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows 10 - Sandboxed Mount Reparse Point Creation Mitigation Bypass (MS15-111)
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wi
23RISCO
abrir ↗Exploit-DB
ZYXEL PMG5318-B20A - OS Command Injection
The diagnostic-ping implementation on ZyXEL PMG5318-B20A devices with firmware before 1.00(AANC.2)C0 allows remote attac
28RISCO
abrir ↗VulnCheck XDB
denial-of-service
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold an
100RISCO
abrir ↗GitHub PoC
Quick and dirty .py for checking (CVE-2015-1635) MS15-034 + DoS attack option
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold an
100RISCO
abrir ↗Exploit-DB
Linux/MIPS Kernel 2.6.36 - 'NetUSB' Remote Code Execution
Stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel, as used in c
28RISCO
abrir ↗Exploit-DB
libsndfile 1.0.25 - Local Heap Overflow
Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex val
28RISCO
abrir ↗Exploit-DB
ZHONE < S3.0.501 - Multiple Vulnerabilities
backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a
23RISCO
abrir ↗Exploit-DB
ZHONE < S3.0.501 - Multiple Vulnerabilities
The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary comm
35RISCO
abrir ↗Exploit-DB
F5 Big-IP 10.2.4 Build 595.0 Hotfix HF3 - Directory Traversal
Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 t
23RISCO
abrir ↗Exploit-DB
ZHONE < S3.0.501 - Multiple Vulnerabilities
The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended a
23RISCO
abrir ↗Metasploit300
Limesurvey Unauthenticated File Download
LimeSurvey 2.0+ - 2.06+ Unauthenticated Arbitrary File Download via Serialized Backup Payload
36RISCO
abrir ↗Metasploit600
Wordpress Ajax Load More PHP Upload Vulnerability
Ajax Load More < 2.8.1.2 - Subscriber+ File Upload & Deletion
36RISCO
abrir ↗Exploit-DB
Kallithea 0.2.9 - 'came_from' HTTP Response Splitting
CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduc
23RISCO
abrir ↗Exploit-DB
Zope Management Interface 4.3.7 - Cross-Site Request Forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone bef
23RISCO
abrir ↗VulnCheck XDB
local
The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data str
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Kaseya Virtual System Administrator (VSA) - 'uploader.aspx' Arbitrary File Upload (Metasploit)
Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
TrueCrypt 7 / VeraCrypt 1.13 - Drive Letter Symbolic Link Creation Privilege Escalation
The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when run
23RISCO
abrir ↗Metasploit300
PDF Shaper Buffer Overflow
PDF Shaper v3.5/3.6 Buffer Overflow via Convert to Image Feature
36RISCO
abrir ↗Metasploit300
ManageEngine ServiceDesk Plus Path Traversal
Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remot
50RISCO
abrir ↗Exploit-DB
ElasticSearch 1.6.0 - Arbitrary File Download
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
60RISCO
abrir ↗Exploit-DB
Bosch Security Systems Dinion NBN-498 - Web Interface XML Injection
The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264 Firmware 4.54.0026 allows r
23RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.