Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.957exploits catalogados

32.195CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8.182Nuclei 4.217Metasploit 3.462✓ só verificadosrecentes populares risco

4.217 exploits

Nucleimedium

Relevanssi (A Better Search) <= 4.22.0 - Query Log Export

CVE-2024-1380MEDIUM

Relevanssi – A Better Search <= 4.22.0 (Free) and <= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log Export

40RISCO

abrir ↗

Nucleimedium

WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scripting

CVE-2024-13853MEDIUM

SEO Tools <= 4.0.7 - Reflected XSS

28RISCO

abrir ↗

Nucleihigh

WPMobile.App <= 11.56 - Open Redirect

CVE-2024-13888HIGH

WPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameter

36RISCO

abrir ↗

Nucleicritical

St. Joe ERP system - SQL Injection

CVE-2024-13979CRITICAL

St. Joe ERP System SingleRowQueryConverter SQL Injection

63RISCO

abrir ↗

Nucleimedium

Studiocart <= 2.9.0 - Cross-Site Scripting

CVE-2024-14015HIGH

Studiocart <= 2.9.0 - Reflected XSS

36RISCO

abrir ↗

Nucleihigh

Mlflow < 2.9.2 - Path Traversal

CVE-2024-1483HIGH

Path Traversal Vulnerability in mlflow/mlflow

36RISCO

abrir ↗

Nucleicritical

MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection

CVE-2024-1512CRITICAL

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection

85RISCO

abrir ↗

Nucleihigh

Gradio 4.3-4.12 - Local File Read

CVE-2024-1561HIGH

Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio

56RISCO

abrir ↗

Nucleicritical

NotificationX <= 2.8.2 - SQL Injection

CVE-2024-1698CRITICAL

NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection

85RISCO

abrir ↗

Nucleicritical

ConnectWise ScreenConnect 23.9.7 - Authentication Bypass

CVE-2024-1709CRITICALsob ataqueransomware

Authentication bypass using an alternate path or channel

100RISCO

abrir ↗

Nucleihigh

Gradio > 4.19.1 UploadButton - Path Traversal

CVE-2024-1728HIGH

Local File Inclusion in gradio-app/gradio

58RISCO

abrir ↗

Nucleihigh

Tutor LMS <= 2.1.10 - SQL Injection

CVE-2024-1751HIGH

Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection

36RISCO

abrir ↗

Nucleimedium

Cisco Finesse - Server-Side Request Forgery (SSRF)

CVE-2024-20404HIGH

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker t

61RISCO

abrir ↗

Nucleicritical

Cisco SSM On-Prem <= 8-202206 - Password Reset Account Takeover

CVE-2024-20419CRITICAL

A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauth

85RISCO

abrir ↗

Nucleicritical

Hardcoded Admin Credentials For Cisco Smart Licensing Utility API

CVE-2024-20439CRITICALsob ataque

A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an a

95RISCO

abrir ↗

Nucleihigh

Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials

CVE-2024-20440HIGH

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive inf

48RISCO

abrir ↗

Nucleihigh

Artica Proxy - Unauthenticated LFI

CVE-2024-2053HIGH

Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability

68RISCO

abrir ↗

Nucleihigh

Adobe ColdFusion - Arbitrary File Read

CVE-2024-20767HIGHsob ataque

ColdFusion | Improper Access Control (CWE-284)

100RISCO

abrir ↗

Nucleihigh

Oracle Retail Xstore Suite - Pre-authenticated Path Traversal

CVE-2024-21136HIGH

Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security). Supported

36RISCO

abrir ↗

Nucleimedium

Dash Framework - Cross-site Scripting

CVE-2024-21485MEDIUM

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; v

28RISCO

abrir ↗

Nucleihigh

MobSF - Path Traversal

CVE-2024-21633HIGH

Arbitrary file write on Decoding

36RISCO

abrir ↗

Nucleimedium

Flarum < 1.8.5 - Open Redirect

CVE-2024-21641MEDIUM

Flarum's Logout Route allows open redirects

28RISCO

abrir ↗

Nucleihigh

pyLoad Flask Config - Access Control

CVE-2024-21644HIGH

pyLoad unauthenticated flask configuration leakage

48RISCO

abrir ↗

Nucleimedium

pyload - Log Injection

CVE-2024-21645MEDIUM

pyLoad Log Injection

33RISCO

abrir ↗

Nucleicritical

XWiki < 4.10.20 - Remote code execution

CVE-2024-21650CRITICAL

XWiki Remote Code Execution vulnerability via user registration

65RISCO

abrir ↗

Nucleihigh

Atlassian Confluence Data Center and Server - Remote Code Execution

CVE-2024-21683HIGH

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and

78RISCO

abrir ↗

Nucleicritical

Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) - Command Injection

CVE-2024-21887CRITICALsob ataqueransomware

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x,

100RISCO

abrir ↗

Nucleihigh

Ivanti SAML - Server Side Request Forgery (SSRF)

CVE-2024-21893HIGHsob ataqueransomware

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy

100RISCO

abrir ↗

Nucleihigh

Ivanti Connect Secure - XXE

CVE-2024-22024HIGH

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Se

78RISCO

abrir ↗

Nucleimedium

Fastify Swagger-UI - Information Disclosure

CVE-2024-22207MEDIUM

Default swagger-ui configuration exposes all files in the module

28RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.