Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.957exploits catalogados

32.195CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8.182Nuclei 4.217Metasploit 3.462✓ só verificadosrecentes populares risco

4.217 exploits

Nucleimedium

Opensis-Classic 8.0 - Cross-Site Scripting

CVE-2021-40542—

Opensis-Classic Version 8.0 is affected by cross-site scripting (XSS). An unauthenticated user can inject and execute Ja

18RISCO

abrir ↗

Nucleimedium

OS4Ed OpenSIS Community 8.0 - Local File Inclusion

CVE-2021-40651—

OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), wh

43RISCO

abrir ↗

Nucleihigh

D-Link DIR-605 - Information Disclosure

CVE-2021-40655HIGHsob ataque

An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name

88RISCO

abrir ↗

Nucleihigh

IND780 - Local File Inclusion

CVE-2021-40661HIGH

A remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Adva

36RISCO

abrir ↗

Nucleicritical

RegistrationMagic <= 5.0.1.7 - Authentication Bypass

CVE-2021-4073CRITICAL

RegistrationMagic <= 5.0.1.7 Authentication Bypass

43RISCO

abrir ↗

Nucleihigh

Geoserver - Server-Side Request Forgery

CVE-2021-40822—

GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.

43RISCO

abrir ↗

Nucleihigh

Auerswald COMfortel 1400/2600/3600 IP - Authentication Bypass

CVE-2021-40856—

Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring.

30RISCO

abrir ↗

Nucleicritical

Auerswald COMpact 5500R 7.8A and 8.0B Devices Backdoor

CVE-2021-40859—

Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web

60RISCO

abrir ↗

Nucleimedium

Cloudron 6.2 Cross-Site Scripting

CVE-2021-40868—

In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.

38RISCO

abrir ↗

Nucleicritical

Aviatrix Controller 6.x before 6.5-1804.1922 - Remote Command Execution

CVE-2021-40870CRITICALsob ataque

An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous

100RISCO

abrir ↗

Nucleihigh

Gurock TestRail Application files.md5 Exposure

CVE-2021-40875—

Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat ac

50RISCO

abrir ↗

Nucleicritical

Galera WebTemplate 1.0 Directory Traversal

CVE-2021-40960—

Galera WebTemplate 1.0 is affected by a directory traversal vulnerability that could reveal information from /etc/passwd

18RISCO

abrir ↗

Nucleimedium

Spotweb <= 1.5.1 - Cross Site Scripting

CVE-2021-40968—

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote

18RISCO

abrir ↗

Nucleimedium

myfactory FMS - Cross-Site Scripting

CVE-2021-42565—

myfactory.FMS before 7.1-912 allows XSS via the UID parameter.

38RISCO

abrir ↗

Nucleimedium

myfactory FMS - Cross-Site Scripting

CVE-2021-42566—

myfactory.FMS before 7.1-912 allows XSS via the Error parameter.

38RISCO

abrir ↗

Nucleimedium

Apereo CAS Cross-Site Scripting

CVE-2021-42567—

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.

18RISCO

abrir ↗

Nucleicritical

D-Link DIR-615 - Unauthorized Access

CVE-2021-42627—

The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without auth

30RISCO

abrir ↗

Nucleimedium

Sourcecodester Online Event Booking and Reservation System 2.3.0 - Cross-Site Scripting

CVE-2021-42663—

An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via th

18RISCO

abrir ↗

Nucleicritical

Online Event Booking and Reservation System 2.3.0 - SQL Injection

CVE-2021-42667—

A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-manag

23RISCO

abrir ↗

Nucleicritical

TOTOLINK EX1200T 4.1.2cu.5215 - Authentication Bypass

CVE-2021-42887—

In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.

30RISCO

abrir ↗

Nucleimedium

Fortinet FortiMail 7.0.1 - Cross-Site Scripting

CVE-2021-43062MEDIUM

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0

53RISCO

abrir ↗

Nucleihigh

Pre-Auth Takeover of Build Pipelines in GoCD

CVE-2021-43287—

An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default,

43RISCO

abrir ↗

Nucleicritical

Studio-42 elFinder <2.1.60 - Arbitrary File Upload

CVE-2021-43421—

A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remot

30RISCO

abrir ↗

Nucleihigh

AlquistManager Local File Inclusion

CVE-2021-43495—

AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnera

18RISCO

abrir ↗

Nucleihigh

Clustering Local File Inclusion

CVE-2021-43496—

Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vuln

23RISCO

abrir ↗

Nucleicritical

Sourcecodester Simple Client Management System 1.0 - SQL Injection

CVE-2021-43510—

SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the username field in login

18RISCO

abrir ↗

Nucleimedium

Atmail 6.5.0 - Cross-Site Scripting

CVE-2021-43574—

WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default U

18RISCO

abrir ↗

Nucleimedium

Spotweb <= 1.5.1 - Cross Site Scripting (Reflected)

CVE-2021-43725—

There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remot

18RISCO

abrir ↗

Nucleihigh

kkFileview v4.0.0 - Local File Inclusion

CVE-2021-43734—

kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file l

23RISCO

abrir ↗

Nucleicritical

WordPress Automatic Plugin - Unauthenticated Options Change

CVE-2021-4374CRITICAL

WordPress Automatic Plugin <= 3.53.2 - Unauthenticated Arbitrary Options Update

48RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.