Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
87.165exploits catalogados
40.552CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.077VulnCheck XDB 10.169Nuclei 4.567Metasploit 3.537✓ só verificadosrecentespopularesrisco
87.166 exploits
Metasploit600
Linksys E-Series TheMoon Remote Command Injection
Linksys Routers E/WAG/WAP/WES/WET/WRT-Series
85RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Easy CD-DA Recorder - '.pls' Local Buffer Overflow (Metasploit)
Stack-based buffer overflow in D.R. Software Audio Converter 8.1, 2007, and 8.05 allows remote attackers to execute arbi
50RISCO
abrir ↗Exploit-DB
CA 2E Web Option 8.1.2 - Authentication Bypass
CA 2E Web Option r8.1.2 accepts a predictable substring of a W2E_SSNID session token in place of the entire token, which
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Apache Commons FileUpload and Apache Tomcat - Denial of Service
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
78RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - TrackPopupMenuEx Win32k NULL Page (MS13-081) (Metasploit)
win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to ga
43RISCO
abrir ↗Exploit-DB
Linux Kernel < 3.4.5 (Android 4.2.2/4.4 ARM) - Local Privilege Escalation
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not
98RISCO
abrir ↗Exploit-DB
Titan FTP Server 10.32 Build 1816 - Directory Traversal
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attacke
38RISCO
abrir ↗Exploit-DB
Titan FTP Server 10.32 Build 1816 - Directory Traversal
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attacke
38RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Tableau Server < 8.0.7 / < 8.1.2 - Blind SQL Injection
SQL injection vulnerability in Tableau Server 8.0.x before 8.0.7 and 8.1.x before 8.1.2 allows remote authenticated user
23RISCO
abrir ↗Metasploit600
Fritz!Box Webcm Unauthenticated Command Injection
AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter t
60RISCO
abrir ↗Exploit-DB
WordPress Plugin BuddyPress 1.9.1 - Privilege Escalation
The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain
28RISCO
abrir ↗Exploit-DB✓ VexDay Proof
KingScada - kxClientDownload.ocx ActiveX Remote Code Execution (Metasploit)
An unspecified ActiveX control in WellinTech KingSCADA before 3.1.2, KingAlarm&Event before 3.1, and KingGraphic before
50RISCO
abrir ↗Exploit-DB
Titan FTP Server 10.32 Build 1816 - Directory Traversal
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attacke
38RISCO
abrir ↗Metasploit500
MS14-009 .NET Deployment Service IE Sandbox Escape
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it
50RISCO
abrir ↗Exploit-DB
ZTE ZXV10 W300 Router - Hard-Coded Credentials
The TELNET service on the ZTE ZXV10 W300 router 2.1.0 has a hardcoded password ending with airocon for the admin account
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Publish-It 3.6d - '.pui' Local Buffer Overflow (SEH)
Buffer overflow in Poster Software PUBLISH-iT 3.6d allows remote attackers to execute arbitrary code via a crafted PUI f
50RISCO
abrir ↗Exploit-DB
AuraCMS 2.3 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Android Browser and WebView addJavascriptInterface - Code Execution (Metasploit)
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
50RISCO
abrir ↗Exploit-DB
doorGets CMS 5.2 - SQL Injection
SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administra
23RISCO
abrir ↗Exploit-DB
CTERA 3.2.29.0/3.2.42.0 - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in CTERA Cloud Storage OS before 3.2.29.0, 3.2.42.0, and earlier allows remote
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
osCommerce 2.3.3.4 - 'geo_zones.php?zID' SQL Injection
SQL injection vulnerability in the update_zone function in catalog/admin/geo_zones.php in osCommerce Online Merchant 2.3
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Publish-It 3.6d - Buffer Overflow
Buffer overflow in Poster Software PUBLISH-iT 3.6d allows remote attackers to execute arbitrary code via a crafted PUI f
50RISCO
abrir ↗GitHub PoC★ 8
Android Data Stealing Vulnerability
The Android browser in Android before 2.3.4 allows remote attackers to obtain SD card contents via crafted content:// UR
43RISCO
abrir ↗Metasploit300
Apache Commons FileUpload and Apache Tomcat DoS
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
78RISCO
abrir ↗Metasploit300
Publish-It PUI Buffer Overflow (SEH)
Buffer overflow in Poster Software PUBLISH-iT 3.6d allows remote attackers to execute arbitrary code via a crafted PUI f
50RISCO
abrir ↗Metasploit300
Adobe Flash Player Integer Underflow Remote Code Execution
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
100RISCO
abrir ↗Exploit-DB
VideoLAN VLC Media Player 2.1.2 - '.asf' Crash (PoC)
The ASF_ReadObject_file_properties function in modules/demux/asf/libasf.c in the ASF Demuxer in VideoLAN VLC Media Playe
23RISCO
abrir ↗Exploit-DB
ownCloud 6.0.0a - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in ownCloud before 6.0.1 allows remote authenticated users to inject arbitrary
23RISCO
abrir ↗Exploit-DB
D-Link DIR-100 - Multiple Vulnerabilities
D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters
28RISCO
abrir ↗Exploit-DB
D-Link DIR-100 - Multiple Vulnerabilities
D-Link DIR-100 4.03B07: cli.cgi CSRF
23RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.