Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
89.426exploits catalogados
41.291CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.792Exploit-DB 24.491GitHub PoC 18.666inteligência de exploração 11.309Nuclei 4.626Metasploit 3.542✓ só verificadosrecentespopularesrisco
11.309 exploits
initial-access
Simple File List < 4.2.3 - Remote Code Execution
75RISCO
local
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISCO
initial-access
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISCO
initial-access
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authen
50RISCO
initial-access
PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_includ
35RISCO
initial-access
Craft CMS Remote Code Execution vulnerability
85RISCO
initial-access
TBK DVR-4104/DVR-4216 os command injection
55RISCO
local
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
35RISCO
client-side
Git allows arbitrary code execution through broken config quoting
71RISCO
initial-access
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISCO
client-side
@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers
75RISCO
initial-access
Argument Injection in PHP-CGI
100RISCO
client-side
Path traversal vulnerability in WinRAR
93RISCO
remote-with-credentials
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the
100RISCO
initial-access
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISCO
infoleak
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.
63RISCO
local
WinVerifyTrust Signature Validation Vulnerability
75RISCO
local
Code Execution / Escalation of Privileges in ThrottleStop
41RISCO
initial-access
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISCO
client-side
WinVerifyTrust Signature Validation Vulnerability
75RISCO
initial-access
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery
60RISCO
initial-access
Tenda AC20 Telnet Service telnet websFormDefine command injection
38RISCO
infoleak
Epsilon Framework Themes (Various Versions) - Function Injection
75RISCO
initial-access
Web-Check allows command Injection via Unvalidated URL in Screenshot API
68RISCO
infoleak
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to re
50RISCO
client-side
Path traversal vulnerability in WinRAR
93RISCO
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISCO
initial-access
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vul
75RISCO
initial-access
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISCO
local
Path traversal vulnerability in WinRAR
93RISCO
Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e bases de inteligência de exploração. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.