Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
71.957exploits catalogados
32.195CVEs com exploração pública
1.932testados em laboratório
TodosExploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8.182Nuclei 4.217Metasploit 3.462✓ só verificadosrecentespopularesrisco
4.217 exploits
Nucleicritical
XWiki Platform - Remote Code Execution
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISCO
abrir ↗Nucleimedium
Vitest Browser Mode - Local File Read
Browser mode serves arbitrary files in vitest
48RISCO
abrir ↗Nucleicritical
SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection
SugarCRM PHP Deserialization RCE
63RISCO
abrir ↗Nucleihigh
Aquatronica Controller System <= 5.1.6 - Information Disclosure
Aquatronica Controller System Complete Information Disclosure
63RISCO
abrir ↗Nucleihigh
Omnissa Workspace ONE UEM - Path Traversal
Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to ga
61RISCO
abrir ↗Nucleicritical
Fortinet FortiWeb - SQL Injection
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISCO
abrir ↗Nucleimedium
Label Studio < 1.16.0 - Cross-Site Scripting
Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint
28RISCO
abrir ↗Nucleihigh
File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read
File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read
56RISCO
abrir ↗Nucleicritical
Vue Vben Admin - Default Credentials
Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials.
43RISCO
abrir ↗Nucleihigh
WordPress The Wound Theme <= 0.0.1 - Local File Inclusion
The Wound <= 0.0.1 - Unauthenticated LFI
36RISCO
abrir ↗Nucleicritical
User Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation
User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation
68RISCO
abrir ↗Nucleihigh
MagnusBilling Login Logs - Cross-Site Scripting
MagnusBilling Stored Cross-Site Scripting in Login Logs
36RISCO
abrir ↗Nucleihigh
MagnusBilling Alarm Module - Cross-Site Scripting
MagnusBilling Stored Cross-Site Scripting in Alarm Module
36RISCO
abrir ↗Nucleicritical
ICTBroadcast - Command Injection
ICTBroadcast <= 7.4 Unauthenticated Session Cookie RCE
63RISCO
abrir ↗Nucleihigh
FlowiseAI Flowise <= 2.2.6 - Arbitrary File Upload
FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.
75RISCO
abrir ↗Nucleihigh
InstaWP Connect < 0.1.0.86 - Local PHP File Inclusion
InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion
41RISCO
abrir ↗Nucleicritical
FREEDOM Administration - Default Login
The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with defaul
43RISCO
abrir ↗Nucleicritical
OttoKit < 1.0.83 - SureTriggers allows Privilege Escalation
WordPress SureTriggers <= 1.0.82 - Privilege Escalation Vulnerability
75RISCO
abrir ↗Nucleimedium
Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
Yonyou UFIDA ERP-NC login.jsp cross site scripting
28RISCO
abrir ↗Nucleimedium
Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
Yonyou UFIDA ERP-NC menu.jsp cross site scripting
28RISCO
abrir ↗Nucleimedium
Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
Yonyou UFIDA ERP-NC systop.jsp cross site scripting
28RISCO
abrir ↗Nucleimedium
Navidrome <=0.54.5 - Authentication Bypass in Subsonic API
Navidrome has authentication bypass in Subsonic API with non-existent username
28RISCO
abrir ↗Nucleimedium
Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
Yonyou UFIDA ERP-NC top.jsp cross site scripting
28RISCO
abrir ↗Nucleihigh
Joplin 3.3.3 Server - Privilege Escalation
Privilege escalation in Joplin server via user patch endpoint
36RISCO
abrir ↗Nucleimedium
Sitecore Experience Manager (XM)/Experience Platform (XP) 10.4 - Insecure Deserialization
Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through
60RISCO
abrir ↗Nucleicritical
TRUfusion Enterprise <= 7.10.4.0 - Path Traversal
TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, t
36RISCO
abrir ↗Nucleicritical
TRUfusion Enterprise <= 7.10.4.0 - Authentication Bypass
TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints s
36RISCO
abrir ↗Nucleihigh
TRUfusion Enterprise <= 7.10.4.0 - Admin Contact Portal
TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unau
41RISCO
abrir ↗Nucleihigh
MeteoBridge <= 6.1 - Remote Code Execution
Arbitrary Command Injection in Smartbedded MeteoBridge
88RISCO
abrir ↗Nucleicritical
Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection
Unauthenticated Arbitrary Command Injection in Evertz SDVN
65RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.