Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
71.957exploits catalogados
32.195CVEs com exploração pública
1.932testados em laboratório
TodosExploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8.182Nuclei 4.217Metasploit 3.462✓ só verificadosrecentespopularesrisco
4.217 exploits
Nucleimedium
pyload-ng js2py - Remote Code Execution
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a
48RISCO
abrir ↗Nucleihigh
LG LED Assistant - Unauthenticated Password Reset
Password reset vulnerability without authorization on LG LED Assistant
55RISCO
abrir ↗Nucleimedium
RiteCMS 3.0.0 - Cross-site Scripting
RiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main_menu/edit_sec
48RISCO
abrir ↗Nucleihigh
LG LED Assistant - Thumbnail Path Traversal File Upload
Path traversal via file upload on LG LED Assistant
40RISCO
abrir ↗Nucleimedium
Coda v.2024Q1 - Cross-Site Scripting
Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary
28RISCO
abrir ↗Nucleihigh
Apache CXF < 4.0.4 - Aegis DataBinding SSRF / Local File Read
Apache CXF SSRF Vulnerability using the Aegis databinding
63RISCO
abrir ↗Nucleicritical
Wordpress Email Subscribers by Icegram Express - SQL Injection
Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection
85RISCO
abrir ↗Nucleihigh
WordPress Plugin LayerSlider 7.9.11-7.10.0 - SQL Injection
The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.1
68RISCO
abrir ↗Nucleicritical
SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization
SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability
95RISCO
abrir ↗Nucleicritical
SolarWinds Web Help Desk - Hardcoded Credential
SolarWinds Web Help Desk Hardcoded Credential Vulnerability
100RISCO
abrir ↗Nucleihigh
SolarWinds Serv-U - Directory Traversal
SolarWinds Serv-U L Directory Transversal Vulnerability
100RISCO
abrir ↗Nucleimedium
Memos 0.13.2 - Server-Side Request Forgery
memos vulnerable to an SSRF in /o/get/httpmeta
28RISCO
abrir ↗Nucleimedium
Memos 0.13.2 - Cross-Site Scripting & SSRF
memos vulnerable to an SSRF in /o/get/image
28RISCO
abrir ↗Nucleimedium
Memos 0.13.2 - Server-Side Request Forgery
memos vulnerable to an SSRF in /api/resource
28RISCO
abrir ↗Nucleihigh
.NET Framework - Leaking ObjRefs via HTTP .NET Remoting
.NET Framework Information Disclosure Vulnerability
100RISCO
abrir ↗Nucleihigh
WordPress Tourfic Plugin <= 2.11.7 - Cross-Site Scripting
WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability
36RISCO
abrir ↗Nucleimedium
WordPress Restrict User Access <= 2.5 - Cross-Site Scripting
WordPress Restrict User Access plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability
36RISCO
abrir ↗Nucleihigh
GeoServer Demo Request Endpoint - Server Side Request Forgery
GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost
36RISCO
abrir ↗Nucleicritical
Telesquare TLR-2005KSH - Remote Command Execution
An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the
56RISCO
abrir ↗Nucleimedium
VvvebJs < 1.7.5 - Arbitrary File Upload
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute
28RISCO
abrir ↗Nucleihigh
MLflow < 2.11.3 - Path Traversal
Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow
41RISCO
abrir ↗Nucleimedium
Unlimited Elements for Elementor <= 1.5.93 - Cross Site Scripting
WordPress Unlimited Elements for Elementor plugin <= 1.5.93 - Reflected Cross Site Scripting (XSS) vulnerability
36RISCO
abrir ↗Nucleicritical
Ivanti EPM - Remote Code Execution
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att
100RISCO
abrir ↗Nucleicritical
Apache StreamPipes <= 0.93.0 - Use of Cryptographically Weak PRNG in Recovery Token Generation
Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation
63RISCO
abrir ↗Nucleihigh
GLPI 10.0.10-10.0.14 - SQL Injection
GLPI contains an SQL injection through the saved searches
48RISCO
abrir ↗Nucleicritical
Cacti cmd_realtime.php - Command Injection
Cacti command injection in cmd_realtime.php
85RISCO
abrir ↗Nucleimedium
WP Go Maps <= 9.0.29 - Cross-Site Scripting
WordPress WP Go Maps plugin <= 9.0.29 - Reflected Cross Site Scripting (XSS) vulnerability
36RISCO
abrir ↗Nucleicritical
Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - NsaRescueAngel Backdoor Account
** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326
85RISCO
abrir ↗Nucleicritical
Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - Command Injection
** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmwar
85RISCO
abrir ↗Nucleicritical
IPS Community Suite - Unauthenticated SQL Injection
Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\
43RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.