Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

72.018exploits catalogados

32.219CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 20.023GitHub PoC 13.334VulnCheck XDB 8.195Nuclei 4.217Metasploit 3.463✓ só verificadosrecentes populares risco

4.217 exploits

Nucleimedium

WordPress Perfect Images (WP Retina 2x) < 6.4.6 - Sensitive Information Exposure

CVE-2023-44982MEDIUM

WordPress WP Retina 2x Plugin <= 6.4.5 is vulnerable to Sensitive Data Exposure

28RISCO

abrir ↗

Nucleimedium

QNAP Music Station < 5.4.0 - Authentication Bypass

CVE-2023-45038MEDIUM

Music Station

28RISCO

abrir ↗

Nucleimedium

XWiki < 14.10.14 - Cross-Site Scripting

CVE-2023-45136CRITICAL

XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled

43RISCO

abrir ↗

Nucleicritical

Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

CVE-2023-4521CRITICAL

Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

75RISCO

abrir ↗

Nucleihigh

PrestaShop PireosPay - SQL Injection

CVE-2023-45375—

In the module "PireosPay" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL

30RISCO

abrir ↗

Nucleicritical

D-Link DAR-8000-10 - Command Injection

CVE-2023-4542MEDIUM

D-Link DAR-8000-10 sys1.php os command injection

70RISCO

abrir ↗

Nucleimedium

SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting

CVE-2023-4547LOW

SPA-Cart eCommerce CMS search cross site scripting

55RISCO

abrir ↗

Nucleimedium

MooSocial 3.1.8 - Cross-Site Scripting

CVE-2023-45542—

Cross Site Scripting vulnerability in mooSocial 3.1.8 allows a remote attacker to obtain sensitive information via a cra

18RISCO

abrir ↗

Nucleimedium

Apache Tomcat - HTTP Request Smuggling

CVE-2023-45648MEDIUM

Apache Tomcat: Trailer header parsing too lenient

28RISCO

abrir ↗

Nucleimedium

Frigate < 0.13.0 Beta 3 - Cross-Site Scripting

CVE-2023-45671MEDIUM

Frigate reflected XSS through `/<camera_name>` API endpoints

28RISCO

abrir ↗

Nucleimedium

PaperCut NG Unauthenticated XMLRPC Functionality

CVE-2023-4568MEDIUM

PaperCut NG Unauthenticated XMLRPC

28RISCO

abrir ↗

Nucleimedium

Leantime < 2.4 - Authenticated SQL Injection

CVE-2023-45826MEDIUM

Authenticated SQL Injection in leantime

28RISCO

abrir ↗

Nucleicritical

Viessmann Vitogate 300 - Remote Code Execution

CVE-2023-45852—

In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute a

23RISCO

abrir ↗

Nucleihigh

qdPM 9.2 - Directory Traversal

CVE-2023-45855—

qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.

18RISCO

abrir ↗

Nucleicritical

Gibbon LMS <= v25.0.01 - File Upload to RCE

CVE-2023-45878—

GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not

50RISCO

abrir ↗

Nucleicritical

WordPress Plugin Forminator 1.24.6 - Arbitrary File Upload

CVE-2023-4596CRITICAL

Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

68RISCO

abrir ↗

Nucleicritical

Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion

CVE-2023-4634CRITICAL

Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution

85RISCO

abrir ↗

Nucleicritical

PrestaShop Step by Step products Pack - SQL Injection

CVE-2023-46347CRITICAL

In the module "Step by Step products Pack" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a

55RISCO

abrir ↗

Nucleicritical

cPH2 Charging Station v1.87.0 - OS Command Injection

CVE-2023-46359CRITICAL

An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthen

65RISCO

abrir ↗

Nucleihigh

GL.iNet <= 4.3.7 - Arbitrary File Write

CVE-2023-46455—

In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attac

30RISCO

abrir ↗

Nucleicritical

TOTOLINK A3700R - Command Injection

CVE-2023-46574—

An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName p

30RISCO

abrir ↗

Nucleicritical

Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload

CVE-2023-4666CRITICAL

Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload

63RISCO

abrir ↗

Nucleimedium

XWiki < 14.10.14 - Cross-Site Scripting

CVE-2023-46732CRITICAL

Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform

43RISCO

abrir ↗

Nucleicritical

F5 BIG-IP - Unauthenticated RCE via AJP Smuggling

CVE-2023-46747CRITICALsob ataqueransomware

BIG-IP Configuration utility unauthenticated remote code execution vulnerability

100RISCO

abrir ↗

Nucleihigh

Ivanti ICS - Authentication Bypass

CVE-2023-46805HIGHsob ataqueransomware

An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a re

100RISCO

abrir ↗

Nucleimedium

OpenCms 14 & 15 - Open Redirect

CVE-2023-6380MEDIUM

Open Redirect in Alkacon Software OpenCms

28RISCO

abrir ↗

Nucleimedium

WordPress Toolbar <= 2.2.6 - Open Redirect

CVE-2023-6389MEDIUM

WordPress Toolbar <= 2.2.6 - Open Redirect

33RISCO

abrir ↗

Nucleimedium

WordPress Download Manager - File Password Exposure

CVE-2023-6421HIGH

Download Manager < 3.2.83 - Unauthenticated Protected File Download Password Leak

36RISCO

abrir ↗

Nucleimedium

Seriously Simple Podcasting < 3.0.0 - Information Disclosure

CVE-2023-6444MEDIUM

Seriously Simple Podcasting < 3.0.0 - Unauthenticated Administrator Email Disclosure

28RISCO

abrir ↗

Nucleihigh

Prime Mover < 1.9.3 - Sensitive Data Exposure

CVE-2023-6505HIGH

Prime Mover < 1.9.3 - Directory Listing to Sensitive Data Exposure

48RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.