Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
86.991exploits catalogados
40.452CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4.561Metasploit 3.537✓ só verificadosrecentespopularesrisco
86.991 exploits
Exploit-DB
Internet Download Manager - OLE Automation Array Remote Code Execution
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISCO
abrir ↗Exploit-DB
TcpDump - rpki_rtr_pdu_print Out-of-Bounds Denial of Service
The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers t
28RISCO
abrir ↗Exploit-DB
Microsoft Word - Local Machine Zone Code Execution (MS15-022)
Microsoft Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Excel 2010 SP2, PowerPoint 2010 SP2, and Word 2010 SP2 all
35RISCO
abrir ↗Exploit-DB
Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (1)
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
43RISCO
abrir ↗Exploit-DB
Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (1)
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18,
23RISCO
abrir ↗Exploit-DB
SquirrelMail < 1.4.5-RC1 - Arbitrary Variable Overwrite
options_identities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the $_POST variable, which
23RISCO
abrir ↗Exploit-DB
sysPass 1.0.9 - SQL Injection
SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitra
23RISCO
abrir ↗Exploit-DB
Pimcore CMS Build 3450 - Directory Traversal
Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permi
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Adobe Flash - opaqueBackground Use-After-Free (Metasploit)
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
100RISCO
abrir ↗Exploit-DB
ZenPhoto 1.4.8 - Multiple Vulnerabilities
The sanitize_string function in ZenPhoto before 1.4.9 utilized the html_entity_decode function after input sanitation, w
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Swim Team 1.44.10777 - Arbitrary File Download
Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allo
50RISCO
abrir ↗Exploit-DB
FreiChat 9.6 - SQL Injection
SQL injection vulnerability in the get_messages function in server/plugins/chatroom/chatroom.php in FreiChat 9.6 allows
23RISCO
abrir ↗Exploit-DB
ZenPhoto 1.4.8 - Multiple Vulnerabilities
Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack
23RISCO
abrir ↗Exploit-DB
ZenPhoto 1.4.8 - Multiple Vulnerabilities
SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands.
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Accellion FTA - getStatus verify_oauth_token Command Execution (Metasploit)
Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metach
60RISCO
abrir ↗Exploit-DB
ArticleFR 3.0.6 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to injec
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Western Digital Arkeia < 11.0.12 - Remote Code Execution (Metasploit)
The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to b
60RISCO
abrir ↗Exploit-DB
Arab Portal 3 - SQL Injection
SQL injection vulnerability in Arab Portal 3 allows remote attackers to execute arbitrary SQL commands via the showemail
23RISCO
abrir ↗Exploit-DB
ArticleFR 3.0.6 - Multiple Vulnerabilities
Multiple cross-site request forgery (CSRF) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers t
23RISCO
abrir ↗Exploit-DB
SO Planning 1.32 - Multiple Vulnerabilities
The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and
23RISCO
abrir ↗Exploit-DB
SO Planning 1.32 - Multiple Vulnerabilities
Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attacke
50RISCO
abrir ↗Exploit-DB
SO Planning 1.32 - Multiple Vulnerabilities
Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which all
28RISCO
abrir ↗Exploit-DB
SO Planning 1.32 - Multiple Vulnerabilities
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the doc
23RISCO
abrir ↗Exploit-DB
SO Planning 1.32 - Multiple Vulnerabilities
Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in
28RISCO
abrir ↗GitHub PoC★ 15
Vulnerability as a service: showcasing CVS-2014-0160, a.k.a. Heartbleed
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RISCO
abrir ↗Metasploit0
MS15-078 Microsoft Windows Font Driver Buffer Overflow
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wi
43RISCO
abrir ↗Metasploit0
MS15-078 Microsoft Windows Font Driver Buffer Overflow
Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2
100RISCO
abrir ↗Metasploit0
ManageEngine EventLog Analyzer Remote Code Execution
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions
60RISCO
abrir ↗GitHub PoC★ 22
Vulnerability as a service: showcasing CVS-2014-6271, a.k.a. Shellshock
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISCO
abrir ↗Metasploit500
Western Digital Arkeia Remote Code Execution
The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to b
60RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.