Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.990exploits catalogados

32.218CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 20.023GitHub PoC 13.319VulnCheck XDB 8.182Nuclei 4.217Metasploit 3.463✓ só verificadosrecentes populares risco

4.217 exploits

Nucleicritical

TitanNit Web Control 2.01/Atemio 7600 - Remote Code Execution

CVE-2024-9166CRITICAL

OS Command Injection in Atelmo Atemio AM 520 HD Full HD Satellite Receiver

63RISCO

abrir ↗

Nucleihigh

Automation By Autonami < 3.3.0 - SQL Injection

CVE-2024-9186HIGH

Automation By Autonami < 3.3.0 - Unauthenticated SQLi

36RISCO

abrir ↗

Nucleicritical

WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update

CVE-2024-9193CRITICAL

WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update

43RISCO

abrir ↗

Nucleicritical

GutenKit <= 2.1.0 - Arbitrary File Upload

CVE-2024-9234CRITICAL

GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload

68RISCO

abrir ↗

Nucleicritical

Grafana Post-Auth DuckDB - SQL Injection To File Read

CVE-2024-9264CRITICAL

Grafana SQL Expressions allow for remote code execution

85RISCO

abrir ↗

Nucleihigh

Polyaxon - Unauthenticated Directory Traversal

CVE-2024-9362HIGH

Directory Traversal in polyaxon/polyaxon

36RISCO

abrir ↗

Nucleicritical

PaloAlto Networks Expedition - Remote Code Execution

CVE-2024-9463CRITICALsob ataque

Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

100RISCO

abrir ↗

Nucleicritical

Post SMTP <= 3.6.0 - Email Log Disclosure

CVE-2025-11833CRITICAL

Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure

75RISCO

abrir ↗

Nucleihigh

MPDV Mikrolab GmbH HYDRA X, MIP 2 & FEDRA 2 - Path Traversal

CVE-2025-12055HIGH

Unauthenticated Local File Disclosure in MPDV Mikrolab MIP 2 / FEDRA 2 / HYDRA X Manufacturing Execution System

36RISCO

abrir ↗

Nucleihigh

Integrate Google Drive <= 1.5.3 - Information Disclosure

CVE-2025-12139HIGH

File Manager for Google Drive – Integrate Google Drive with WordPress <= 1.5.3 - Unauthenticated Sensitive Information Exposure

36RISCO

abrir ↗

Nucleihigh

Site Reviews < 7.2.5 - Unauthenticated Stored XSS

CVE-2025-1232HIGH

Site Reviews < 7.2.5 - Unauthenticated Stored XSS

36RISCO

abrir ↗

Nucleicritical

Triofox - Improper Access Control

CVE-2025-12480CRITICALsob ataque

Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to init

95RISCO

abrir ↗

Nucleimedium

SureForms <= 1.13.1 - Sensitive Information Exposure

CVE-2025-12536MEDIUM

SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure

28RISCO

abrir ↗

Nucleihigh

WordPress Bookit < 2.5.1 - Unauthenticated Stripe Settings Update

CVE-2025-12841MEDIUM

Bookit < 2.5.1 – Unauthenticated Settings Update

28RISCO

abrir ↗

Nucleicritical

JSONPath Plus < 10.3.0 - Remote Code Execution

CVE-2025-1302CRITICAL

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input

68RISCO

abrir ↗

Nucleimedium

Plugin Oficial – Getnet para WooCommerce <= 1.8.0 - Cross-Site Scripting

CVE-2025-1303MEDIUM

Plugin Oficial – Getnet para WooCommerce <= 1.7.3 - Unauthenticated Reflected XSS

28RISCO

abrir ↗

Nucleihigh

WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection

CVE-2025-13138HIGH

WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function

36RISCO

abrir ↗

Nucleihigh

WP-Recall – Plugin <= 16.26.10 - Unauthenticated SQL Injection

CVE-2025-1323HIGH

WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL Injection

36RISCO

abrir ↗

Nucleicritical

Twonky Server 8.5.2 on Linux and Windows - Log File Exposure

CVE-2025-13315CRITICAL

Unauthenticated log access in Twonky Server

75RISCO

abrir ↗

Nucleihigh

Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read

CVE-2025-13339HIGH

Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read

36RISCO

abrir ↗

Nucleicritical

NUUO Camera <=20250203 - OS Command Injection

CVE-2025-1338MEDIUM

NUUO Camera handle_config.php print_file command injection

60RISCO

abrir ↗

Nucleicritical

WP Directory Kit <= 1.4.4 - Authentication Bypass

CVE-2025-13390CRITICAL

WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover

63RISCO

abrir ↗

Nucleimedium

Responsive Pricing Table <= 5.1.12 - Cross-Site Scripting

CVE-2025-13418MEDIUM

Responsive Pricing Table <= 5.1.12 - Authenticated (Author+) Stored Cross-Site Scripting

28RISCO

abrir ↗

Nucleicritical

Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution

CVE-2025-13486CRITICAL

Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form

85RISCO

abrir ↗

Nucleihigh

IP2Location Country Blocker < 2.38.9 - Unauthenticated Information Disclosure

CVE-2025-1361HIGH

IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function

36RISCO

abrir ↗

Nucleicritical

WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection

CVE-2025-13652MEDIUM

CBX Bookmark & Favorite <= 2.0.4 - Authenticated (Subscriber+) SQL Injection via `orderby` Parameter

28RISCO

abrir ↗

Nucleicritical

WordPress Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Remote Code Execution

CVE-2025-13773CRITICAL

Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Execution

43RISCO

abrir ↗

Nucleihigh

Yoco Payments <= 3.8.8 - Path Traversal

CVE-2025-13801HIGH

Yoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read

36RISCO

abrir ↗

Nucleimedium

WP Directory Kit < 1.5.0 - Unauthenticated Email Exposure

CVE-2025-13920MEDIUM

WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action

28RISCO

abrir ↗

Nucleimedium

LearnPress < 4.3.2 - Broken Access Control

CVE-2025-13956MEDIUM

LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure

28RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.