Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
86.991exploits catalogados
40.452CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4.561Metasploit 3.537✓ só verificadosrecentespopularesrisco
86.991 exploits
Exploit-DB
WordPress Plugin WonderPlugin Audio Player 2.0 - Blind SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Fancybox 3.0.2 - Persistent Cross-Site Scripting
The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote atta
23RISCO
abrir ↗Exploit-DB
PCMan FTP Server 2.0.7 - 'MKD' Remote Buffer Overflow
Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USE
50RISCO
abrir ↗Metasploit300
D-Link Devices HNAP SOAPAction-Header Command Execution
The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute ar
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Webdorado Spider Event Calendar 1.4.9 - SQL Injection
SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQ
43RISCO
abrir ↗Exploit-DB
WordPress Plugin Video Gallery 2.7.0 - SQL Injection
SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin b
50RISCO
abrir ↗Exploit-DB
WordPress Plugin Video Gallery 2.7.0 - SQL Injection
Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly
23RISCO
abrir ↗Exploit-DB
Exponent CMS 2.3.1 - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, an
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
SixApart MovableType < 5.2.12 - Storable Perl Code Execution (Metasploit)
Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use
60RISCO
abrir ↗Metasploit600
ElasticSearch Search Groovy Sandbox Bypass
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
100RISCO
abrir ↗Metasploit600
WordPress Holding Pattern Theme Arbitrary File Upload
Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 a
50RISCO
abrir ↗Metasploit400
SixApart MovableType Storable Perl Code Execution
Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use
60RISCO
abrir ↗Metasploit600
Maarch LetterBox Unrestricted File Upload
Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earl
50RISCO
abrir ↗Exploit-DB
SoftSphere DefenseWall FW/IPS 3.24 - Local Privilege Escalation
The dwall.sys driver in SoftSphere DefenseWall Personal Firewall 3.24 allows local users to write data to arbitrary memo
23RISCO
abrir ↗Exploit-DB
WordPress Plugin Survey and Poll 1.1 - Blind SQL Injection
SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 fo
23RISCO
abrir ↗Exploit-DB
IBM Endpoint Manager - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the Relay Diagnostic page in IBM Tivoli Endpoint Manager 9.1 before 9.1.1229
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Theme Holding Pattern - Arbitrary File Upload (Metasploit)
Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 a
50RISCO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin WP EasyCart - Unrestricted Arbitrary File Upload (Metasploit)
Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka Wor
50RISCO
abrir ↗Exploit-DB
u5CMS 3.9.3 - Multiple Persistent Cross-Site Scripting / Reflected Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in u5CMS before 3.9.4 allow remote attackers to inject arbitrary web
23RISCO
abrir ↗Exploit-DB
RedaxScript CMS 2.2.0 - SQL Injection
SQL injection vulnerability in the search_post function in includes/search.php in Redaxscript before 2.3.0 allows remote
23RISCO
abrir ↗Exploit-DB
ManageEngine OpManager / Applications Manager / IT360 - 'FailOverServlet' Multiple Vulnerabilities
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, O
60RISCO
abrir ↗Exploit-DB
u5CMS 3.9.3 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in u5CMS before 3.9.4 allow remote attackers to execute arbitrary SQL commands vi
23RISCO
abrir ↗Exploit-DB
ManageEngine OpManager / Applications Manager / IT360 - 'FailOverServlet' Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpMan
28RISCO
abrir ↗Metasploit300
WordPress WPLMS Theme Privilege Escalation
WPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege Escalation
36RISCO
abrir ↗Exploit-DB
Fork CMS 3.8.5 - SQL Injection
Multiple SQL injection vulnerabilities in Translations in Fork CMS before 3.8.6 allow remote authenticated users to exec
23RISCO
abrir ↗Exploit-DB
u5CMS 3.9.3 - 'deletefile.php' Arbitrary File Deletion
Directory traversal vulnerability in u5admin/deletefile.php in u5CMS before 3.9.4 allows remote attackers to write to ar
23RISCO
abrir ↗Exploit-DB
Achat 0.150 beta7 - Remote Buffer Overflow
Multiple open redirect vulnerabilities in u5CMS before 3.9.4 allow remote attackers to redirect users to arbitrary web s
23RISCO
abrir ↗Exploit-DB
Achat 0.150 beta7 - Remote Buffer Overflow
Directory traversal vulnerability in u5admin/deletefile.php in u5CMS before 3.9.4 allows remote attackers to write to ar
23RISCO
abrir ↗Exploit-DB
Magento Server MAGMI Plugin - Multiple Vulnerabilities
Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento
50RISCO
abrir ↗Exploit-DB
Magento Server MAGMI Plugin - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server a
43RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.