Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.957exploits catalogados

32.195CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8.182Nuclei 4.217Metasploit 3.462✓ só verificadosrecentes populares risco

4.217 exploits

Nucleimedium

PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting

CVE-2023-41538—

phpjabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter.

18RISCO

abrir ↗

Nucleimedium

WordPress Perfect Images (WP Retina 2x) < 6.4.6 - Sensitive Information Exposure

CVE-2023-44982MEDIUM

WordPress WP Retina 2x Plugin <= 6.4.5 is vulnerable to Sensitive Data Exposure

28RISCO

abrir ↗

Nucleimedium

QNAP Music Station < 5.4.0 - Authentication Bypass

CVE-2023-45038MEDIUM

Music Station

28RISCO

abrir ↗

Nucleimedium

XWiki < 14.10.14 - Cross-Site Scripting

CVE-2023-45136CRITICAL

XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled

43RISCO

abrir ↗

Nucleicritical

Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

CVE-2023-4521CRITICAL

Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

75RISCO

abrir ↗

Nucleihigh

PrestaShop PireosPay - SQL Injection

CVE-2023-45375—

In the module "PireosPay" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL

30RISCO

abrir ↗

Nucleicritical

D-Link DAR-8000-10 - Command Injection

CVE-2023-4542MEDIUM

D-Link DAR-8000-10 sys1.php os command injection

70RISCO

abrir ↗

Nucleimedium

SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting

CVE-2023-4547LOW

SPA-Cart eCommerce CMS search cross site scripting

55RISCO

abrir ↗

Nucleimedium

MooSocial 3.1.8 - Cross-Site Scripting

CVE-2023-45542—

Cross Site Scripting vulnerability in mooSocial 3.1.8 allows a remote attacker to obtain sensitive information via a cra

18RISCO

abrir ↗

Nucleimedium

Apache Tomcat - HTTP Request Smuggling

CVE-2023-45648MEDIUM

Apache Tomcat: Trailer header parsing too lenient

28RISCO

abrir ↗

Nucleimedium

Frigate < 0.13.0 Beta 3 - Cross-Site Scripting

CVE-2023-45671MEDIUM

Frigate reflected XSS through `/<camera_name>` API endpoints

28RISCO

abrir ↗

Nucleimedium

PaperCut NG Unauthenticated XMLRPC Functionality

CVE-2023-4568MEDIUM

PaperCut NG Unauthenticated XMLRPC

28RISCO

abrir ↗

Nucleimedium

Leantime < 2.4 - Authenticated SQL Injection

CVE-2023-45826MEDIUM

Authenticated SQL Injection in leantime

28RISCO

abrir ↗

Nucleicritical

Viessmann Vitogate 300 - Remote Code Execution

CVE-2023-45852—

In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute a

23RISCO

abrir ↗

Nucleihigh

qdPM 9.2 - Directory Traversal

CVE-2023-45855—

qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.

18RISCO

abrir ↗

Nucleicritical

Gibbon LMS <= v25.0.01 - File Upload to RCE

CVE-2023-45878—

GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not

50RISCO

abrir ↗

Nucleicritical

WordPress Plugin Forminator 1.24.6 - Arbitrary File Upload

CVE-2023-4596CRITICAL

Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

68RISCO

abrir ↗

Nucleicritical

Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion

CVE-2023-4634CRITICAL

Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution

85RISCO

abrir ↗

Nucleicritical

PrestaShop Step by Step products Pack - SQL Injection

CVE-2023-46347CRITICAL

In the module "Step by Step products Pack" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a

55RISCO

abrir ↗

Nucleicritical

cPH2 Charging Station v1.87.0 - OS Command Injection

CVE-2023-46359CRITICAL

An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthen

65RISCO

abrir ↗

Nucleihigh

GL.iNet <= 4.3.7 - Arbitrary File Write

CVE-2023-46455—

In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attac

30RISCO

abrir ↗

Nucleicritical

TOTOLINK A3700R - Command Injection

CVE-2023-46574—

An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName p

30RISCO

abrir ↗

Nucleicritical

Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload

CVE-2023-4666CRITICAL

Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload

63RISCO

abrir ↗

Nucleimedium

XWiki < 14.10.14 - Cross-Site Scripting

CVE-2023-46732CRITICAL

Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform

43RISCO

abrir ↗

Nucleicritical

F5 BIG-IP - Unauthenticated RCE via AJP Smuggling

CVE-2023-46747CRITICALsob ataqueransomware

BIG-IP Configuration utility unauthenticated remote code execution vulnerability

100RISCO

abrir ↗

Nucleihigh

Ivanti ICS - Authentication Bypass

CVE-2023-46805HIGHsob ataqueransomware

An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a re

100RISCO

abrir ↗

Nucleihigh

ISPConfig - PHP Code Injection

CVE-2023-46818HIGH

An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by

41RISCO

abrir ↗

Nucleihigh

Chaosblade < 1.7.4 - Remote Code Execution

CVE-2023-47105HIGH

exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd p

36RISCO

abrir ↗

Nucleihigh

Label Studio - Cross-Site Scripting

CVE-2023-47115HIGH

Label Studio XSS Vulnerability on Avatar Upload

36RISCO

abrir ↗

Nucleihigh

Label Studio - Sensitive Information Exposure

CVE-2023-47117HIGH

Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio

36RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.