Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
86.991exploits catalogados
40.452CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4.561Metasploit 3.537✓ só verificadosrecentespopularesrisco
86.991 exploits
Exploit-DB
Openfire 3.10.2 - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject
23RISCO
abrir ↗Exploit-DB
Openfire 3.10.2 - Privilege Escalation
Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows 10 (Build 10130) - User Mode Font Driver Thread Permissions Privilege Escalation
The Adobe Type Manager Library in Microsoft Windows 10 allows local users to gain privileges via a crafted application,
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Media Center - MCL (MS15-100) (Metasploit)
Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remo
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - CreateObjectTask TileUserBroker Privilege Escalation
Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not proper
23RISCO
abrir ↗Metasploit0
ManageEngine OpManager Remote Code Execution
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL q
60RISCO
abrir ↗Metasploit0
ManageEngine OpManager Remote Code Execution
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser a
50RISCO
abrir ↗Exploit-DB✓ VexDay Proof
ManageEngine EventLog Analyzer < 10.6 build 10060 - SQL Execution
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions
60RISCO
abrir ↗VulnCheck XDB
denial-of-service
The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data str
23RISCO
abrir ↗Exploit-DB
Microsoft Windows Media Center - Command Execution (MS15-100)
Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remo
60RISCO
abrir ↗Exploit-DB
OpenLDAP 2.4.42 - ber_get_next Denial of Service
The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a de
28RISCO
abrir ↗Exploit-DB
Synology Video Station 1.5-0757 - Multiple Vulnerabilities
Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharact
28RISCO
abrir ↗Exploit-DB
Synology Video Station 1.5-0757 - Multiple Vulnerabilities
SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL c
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX Install.Framework - SUID Root Runner Binary Privilege Escalation
Race condition in runner in Install.framework in the Install Framework Legacy component in Apple OS X before 10.10.5 all
23RISCO
abrir ↗GitHub PoC★ 205
An exploit for CVE-2015-1538-1 - Google Stagefright ‘stsc’ MP4 Atom Integer Overflow Remote Code Execution
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
45RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX - Install.framework suid Helper Privilege Escalation
runner in Install.framework in the Install Framework Legacy subsystem in Apple OS X before 10.10.4 does not properly dro
23RISCO
abrir ↗GitHub PoC★ 1
An exploit for CVE-2015-1538-1 - Google Stagefright ‘stsc’ MP4 Atom Integer Overflow Remote Code Execution
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
45RISCO
abrir ↗GitHub PoC★ 12
Archive from the article CVE-2015-5119 Flash ByteArray UaF: A beginner's walkthrough
Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX Install.Framework - Arbitrary mkdir / unlink and chown to Admin Group
runner in Install.framework in the Install Framework Legacy component in Apple OS X before 10.10.5 does not properly dro
23RISCO
abrir ↗VulnCheck XDB
client-side
Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.
100RISCO
abrir ↗Exploit-DB
Qlikview 11.20 SR11 - Blind XML External Entity Injection
XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server
28RISCO
abrir ↗GitHub PoC★ 3
An exploit for CVE-2015-1538-1 - Google Stagefright ‘stsc’ MP4 Atom Integer Overflow Remote Code Execution
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
45RISCO
abrir ↗Exploit-DB
Auto-Exchanger 5.1.0 - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in Auto-Exchanger 5.1.0 allows remote attackers to hijack the authentica
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
PHP 5.4/5.5/5.6 - SplDoublyLinkedList 'Unserialize()' Use-After-Free
Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote
35RISCO
abrir ↗Exploit-DB✓ VexDay Proof
PHP Session Deserializer - Use-After-Free
The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_
35RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Google Android - 'Stagefright' Remote Code Execution
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
45RISCO
abrir ↗Exploit-DB✓ VexDay Proof
PHP 5.4/5.5/5.6 - SplObjectStorage 'Unserialize()' Use-After-Free
Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote
35RISCO
abrir ↗Metasploit600
MS15-100 Microsoft Windows Media Center MCL Vulnerability
Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remo
60RISCO
abrir ↗GitHub PoC★ 1
drone789/CVE-2012-1823
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
100RISCO
abrir ↗VulnCheck XDB
initial-access
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.