Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
89.220exploits catalogados
41.197CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.738Exploit-DB 24.490GitHub PoC 18.525inteligência de exploração 11.299Nuclei 4.626Metasploit 3.542✓ só verificadosrecentespopularesrisco
11.299 exploits
initial-access
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26
63RISCO
info-leak
An issue in the getcfg.php component of D-Link DIR816L_FW206b01 allows attackers to access the device via a crafted payl
28RISCO
initial-access
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26
48RISCO
initial-access
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can by
100RISCO
initial-access
TOTOLINK X5000R cstecgi.cgi snprintf os command injection
33RISCO
initial-access
A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1_FW102B02 within the `prog.cgi` a
41RISCO
initial-access
UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc
41RISCO
initial-access
A stack-based buffer overflow on DrayTek Vigor2960, Vigor3900, and Vigor300B devices before 1.5.1.1 allows remote attack
23RISCO
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
client-side
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISCO
initial-access
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat
100RISCO
initial-access
RCE via stale global state
100RISCO
initial-access
A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `sys
33RISCO
initial-access
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attac
50RISCO
initial-access
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat
100RISCO
remote-with-credentials
Redis Lua Use-After-Free may lead to remote code execution
85RISCO
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
initial-access
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running In
48RISCO
initial-access
Totolink A7000R cstecgi.cgi setUnloadUserData command injection
33RISCO
initial-access
Samba: samba: remote code execution in printing subsystem via unescaped job description
68RISCO
initial-access
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
85RISCO
initial-access
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISCO
local
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISCO
local
The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consid
23RISCO
remote-with-credentials
Integer Overflow or Wraparound in GitLab
100RISCO
initial-access
Out-of-Bounds Write in Google Brotli Decoder
70RISCO
local
crypto: algif_aead - Revert to operating out-of-place
100RISCO
local
crypto: algif_aead - Revert to operating out-of-place
100RISCO
local
crypto: algif_aead - Revert to operating out-of-place
100RISCO
local
crypto: algif_aead - Revert to operating out-of-place
100RISCO
Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e bases de inteligência de exploração. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.