Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
71.957exploits catalogados
32.195CVEs com exploração pública
1.932testados em laboratório
TodosExploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8.182Nuclei 4.217Metasploit 3.462✓ só verificadosrecentespopularesrisco
4.217 exploits
Nucleimedium
Drupal 11.x-dev - Full Path Disclosure
core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash
48RISCO
abrir ↗Nucleicritical
SafeGuard for Privileged Passwords < 7.5.2 - Authentication Bypass
One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to c
55RISCO
abrir ↗Nucleicritical
Apache OFBiz - Remote Code Execution
Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE
58RISCO
abrir ↗Nucleimedium
XWiki Platform - Unauthorized Document History Access
XWiki Platform document history including authors of any page exposed to unauthorized actors
28RISCO
abrir ↗Nucleicritical
ASIS - SQL Injection Authentication Bypass
ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for A
55RISCO
abrir ↗Nucleicritical
ArForms < 6.6 - Remote Code Execution
ArForms < 6.6 - Unauthenticated RCE
63RISCO
abrir ↗Nucleimedium
FXServer < v9601 - Information Exposure
Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary
43RISCO
abrir ↗Nucleicritical
NetAlertX 23.01.14–24.x < 24.10.12 - Remote Code Execution
NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because fun
75RISCO
abrir ↗Nucleihigh
Yeti Platform < 2.1.12 - Server-Side Template Injection to RCE
A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti befor
56RISCO
abrir ↗Nucleicritical
DATAGERRY - REST API Auth Bypass
Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests.
63RISCO
abrir ↗Nucleihigh
Sitecore Experience Platform <= 10.4 - Arbitrary File Read
An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0
48RISCO
abrir ↗Nucleicritical
Camaleon CMS < 2.8.1 Arbitrary File Write to RCE
Arbitrary file write leading to RCE in Camaleon CMS
75RISCO
abrir ↗Nucleicritical
Navidrome < 0.53.0 - Authenticated SQL Injection
Multiple SQL Injections and ORM Leak in navidrome
63RISCO
abrir ↗Nucleicritical
DataEase v2.10.2 - JWT Signature Verification Bypass
Dataease arbitrary interface access vulnerability
43RISCO
abrir ↗Nucleimedium
Templately <= 3.1.2 - Broken Access Control
WordPress Templately plugin <= 3.1.2 - Broken Access Control vulnerability
28RISCO
abrir ↗Nucleihigh
LiteSpeed Cache <= 6.5.0.2 - Stored XSS
WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability
36RISCO
abrir ↗Nucleicritical
Cobbler 'XML-RPC' - Authentication Bypass
Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes
63RISCO
abrir ↗Nucleihigh
NAKIVO Backup and Replication Solution - Unauthenticated Arbitrary File Read
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /
100RISCO
abrir ↗Nucleicritical
Fortra FileCatalyst Workflow <= v5.1.6 - SQL Injection
SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)
65RISCO
abrir ↗Nucleimedium
Ganglia Web Interface (v3.7.3 - v3.7.6) - Cross-Site Scripting
A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows atta
28RISCO
abrir ↗Nucleimedium
Ganglia Web Interface (v3.7.3 - v3.7.5) - Cross-Site Scripting
A cross-site scripting (XSS) vulnerability in the component /graph_all_periods.php of Ganglia-web v3.73 to v3.75 allows
28RISCO
abrir ↗Nucleihigh
Kerio Control v9.2.5 - CRLF Injection
An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertE
41RISCO
abrir ↗Nucleicritical
Dolibarr ERP CMS `list.php` - SQL Injection
Multiple vulnerabilities in DOLIBARR's ERP CMS
55RISCO
abrir ↗Nucleimedium
WordPress Events Calendar 6.8.2.1 - Information Disclosure
The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure
28RISCO
abrir ↗Nucleicritical
SSL VPN Session Hijacking
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authe
100RISCO
abrir ↗Nucleicritical
Mongoose < 8.8.3 - Remote Code Execution
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.
63RISCO
abrir ↗Nucleihigh
Discourse Backup File Disclosure Via Default Nginx Configuration
Potential Backup file leaked via Nginx in Discourse
41RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.