Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
87.168exploits catalogados
40.553CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4.567Metasploit 3.537✓ só verificadosrecentespopularesrisco
87.168 exploits
Exploit-DB
Microsoft Windows - HWND_BROADCAST (PoC) (MS13-005)
win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7
43RISCO
abrir ↗Exploit-DB
Linksys WRT160N - Multiple Vulnerabilities
Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attackers
28RISCO
abrir ↗Metasploit600
Linksys WRT160nv2 apply.cgi Remote Command Injection
Linksys Routers apply.cgi Remote Command Injection
36RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Schneider Electric Accutech Manager - Heap Overflow (PoC)
Heap-based buffer overflow in RFManagerService.exe in Schneider Electric Accutech Manager 2.00.1 and earlier allows remo
28RISCO
abrir ↗GitHub PoC★ 3
MySQL-Fu is a Ruby based MySQL Client Script I wrote. It does most of the stuff a normal MySQL client might do: SQL Shell, Update/Delete/Drop Database/Table, Add/Delete Users, Dump Database(s)/Table w/ option for gzip...... Plus a few extra options to make life a little easier for pentests. Includes Several builtin PHP Command Shell options as well as Pentestmonkey's PHP Reverse Shell, in addition to multiple options for file writing and reading (all files read logged locally for offline analysis later), also includes Ruby port of Kingcope's CVE-2012-5613 Linux MySQL Privilege Escalation Exploit.
MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the
50RISCO
abrir ↗Metasploit300
Adobe Flash Player Regular Expression Heap Overflow
Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x
60RISCO
abrir ↗Metasploit300
D-Link hedwig.cgi Buffer Overflow in Cookie Header
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. A1) with firmware before 1.04B11 allo
43RISCO
abrir ↗Metasploit300
D-Link authentication.cgi Buffer Overflow
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. A1) with firmware before 1.04B11 allo
43RISCO
abrir ↗Metasploit600
D-Link DIR615h OS Command Injection
D-Link Routers tools_vct.htm OS Command Injection
41RISCO
abrir ↗Exploit-DB✓ VexDay Proof
CubeCart 5.2.0 - 'cubecart.class.php' PHP Object Injection
The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to un
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Cool PDF Reader 3.0.2.256 - Buffer Overflow
Stack-based buffer overflow in the reader in CoolPDF 3.0.2.256 allows remote attackers to execute arbitrary code via a P
43RISCO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Wysija Newsletters - Multiple SQL Injections
Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenti
23RISCO
abrir ↗Metasploit600
Netgear DGN1000B setup.cgi Remote Command Execution
Netgear Routers setup.cgi RCE
36RISCO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin CommentLuv - '_ajax_nonce' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
VMware OVF Tools - Format String (Metasploit) (1)
Format string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Pl
50RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Cisco Unity Express - Multiple Vulnerabilities
Multiple cross-site request forgery (CSRF) vulnerabilities on the Cisco Unity Express with software before 8.0 allow rem
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Portable UPnP SDK - 'unique_service_name()' Remote Code Execution (Metasploit)
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
35RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Portable UPnP SDK - 'unique_service_name()' Remote Code Execution (Metasploit)
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
60RISCO
abrir ↗Metasploit300
Linksys E1500/E2500 Remote Command Execution
Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version
41RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Opera SVG - Use-After-Free
Opera before 12.13 allows remote attackers to execute arbitrary code via crafted clipPaths in an SVG document.
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Portable UPnP SDK - 'unique_service_name()' Remote Code Execution (Metasploit)
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Portable UPnP SDK - 'unique_service_name()' Remote Code Execution (Metasploit)
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
35RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Portable UPnP SDK - 'unique_service_name()' Remote Code Execution (Metasploit)
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
35RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Portable UPnP SDK - 'unique_service_name()' Remote Code Execution (Metasploit)
Samsung Kies Air 2.1.207051 and 2.1.210161 relies on the IP address for authentication, which allows remote man-in-the-m
23RISCO
abrir ↗Exploit-DB
FreeBSD 9.1 - 'ftpd' Remote Denial of Service
The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand expressions cont
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Portable UPnP SDK - 'unique_service_name()' Remote Code Execution (Metasploit)
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
35RISCO
abrir ↗Exploit-DB
Linux Kernel 2.6.32-5 (Debian 6.0.5) - '/dev/ptmx' Key Stroke Timing Local Disclosure
The Linux kernel through 3.7.9 allows local users to obtain sensitive information about keystroke timing by using the in
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Portable UPnP SDK - 'unique_service_name()' Remote Code Execution (Metasploit)
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
35RISCO
abrir ↗Metasploit300
OpenSSL TLS 1.1 and 1.2 AES-NI DoS
crypto/evp/e_aes_cbc_hmac_sha1.c in the AES-NI functionality in the TLS 1.1 and 1.2 implementations in OpenSSL 1.0.1 bef
30RISCO
abrir ↗Metasploit600
Linksys E1500/E2500 apply.cgi Remote Command Injection
Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version
41RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.