Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

87.331exploits catalogados
40.631CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.377Exploit-DB 24.489GitHub PoC 18.131VulnCheck XDB 10.218Nuclei 4.577Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.331 exploits
GitHub PoC★ 16
Python Apache Killer (Range Header DoS CVE-2011-3192)
CVE-2011-3192—26 out 2011
The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attac
60RISCO
abrir ↗
Exploit-DB
Online Subtitles Workshop - Cross-Site Scripting
CVE-2011-5185—webappsphp26 out 2011
Cross-site scripting (XSS) vulnerability in video_comments.php in Online Subtitles Workshop before 2.0 rev 131 allows re
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
phpScheduleIt 1.2.10 - 'reserve.php' Arbitrary Code Injection (Metasploit)
CVE-2008-6132—webappsphp26 out 2011
Eval injection vulnerability in reserve.php in phpScheduleIt 1.2.10 and earlier, when magic_quotes_gpc is disabled, allo
43RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
phpLDAPadmin 1.2.1.1 - Remote PHP Code Injection (Metasploit) (2)
CVE-2011-4075—webappsphp25 out 2011
The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary
50RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
e107 0.7.24 - 'cmd' Remote Command Execution
CVE-2011-1513—webappsphp24 out 2011
Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the installat
23RISCO
abrir ↗
Metasploit600
phpLDAPadmin query_engine Remote PHP Code Injection
CVE-2011-4075—24 out 2011
The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary
50RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
phpLDAPadmin 1.2.1.1 - Remote PHP Code Injection (1)
CVE-2011-4074—webappsphp23 out 2011
Cross-site scripting (XSS) vulnerability in cmd.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to inject
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Microsoft Win32k - Null Pointer De-reference (PoC) (MS11-077)
CVE-2011-1985HIGHdoswindows23 out 2011
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, W
41RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
phpLDAPadmin 1.2.1.1 - Remote PHP Code Injection (1)
CVE-2011-4075—webappsphp23 out 2011
The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary
50RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
DELL Quest One Password Manager - CAPTCHA Security Bypass
CVE-2013-6246—remotemultiple21 out 2011
The Dell Quest One Password Manager, possibly 5.0, allows remote attackers to bypass CAPTCHA protections and obtain sens
23RISCO
abrir ↗
Exploit-DB
SportsPHool 1.0 - Remote File Inclusion
CVE-2006-4278—webappsphp21 out 2011
PHP remote file inclusion vulnerability in includes/layout/plain.footer.php in SportsPHool 1.0 allows remote attackers t
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
HP Power Manager - 'formExportDataLogs' Remote Buffer Overflow (Metasploit)
CVE-2009-3999—remotecgi20 out 2011
Stack-based buffer overflow in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to ex
60RISCO
abrir ↗
Exploit-DB
OCS Inventory NG 2.0.1 - Persistent Cross-Site Scripting
CVE-2011-4024—webappswindows20 out 2011
Cross-site scripting (XSS) vulnerability in ocsinventory in OCS Inventory NG 2.0.1 and earlier allows remote attackers t
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Pre Studio Business Cards Designer - SQL Injection
CVE-2011-5139—webappsasp20 out 2011
SQL injection vulnerability in page.php in Pre Studio Business Cards Designer allows remote attackers to execute arbitra
23RISCO
abrir ↗
Metasploit300
AdminStudio LaunchHelp.dll ActiveX Arbitrary Code Execution
CVE-2011-2657—19 out 2011
Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in Laun
50RISCO
abrir ↗
Metasploit300
HP Power Manager 'formExportDataLogs' Buffer Overflow
CVE-2009-3999—19 out 2011
Stack-based buffer overflow in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to ex
60RISCO
abrir ↗
Metasploit600
Java Applet Rhino Script Engine Remote Code Execution
CVE-2011-3544CRITICALsob ataque18 out 2011
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and
100RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Apple Safari Webkit - libxslt Arbitrary File Creation (Metasploit)
CVE-2011-1425—remotewindows18 out 2011
xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, a
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Apple Safari Webkit - libxslt Arbitrary File Creation (Metasploit)
CVE-2011-1774—remotewindows18 out 2011
WebKit in Apple Safari before 5.0.6 has improper libxslt security settings, which allows remote attackers to create arbi
50RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Toshiba e-Studio (Multiple Devices) - Security Bypass
CVE-2012-1239—remotemultiple17 out 2011
The TopAccess web-based management interface on TOSHIBA TEC e-Studio multi-function peripheral (MFP) devices with firmwa
23RISCO
abrir ↗
Exploit-DB
GNUBoard 4.33.02 - 'tp.php?PATH_INFO' SQL Injection
CVE-2011-4066—webappsphp17 out 2011
SQL injection vulnerability in bbs/tb.php in Gnuboard 4.33.02 and earlier allows remote attackers to execute arbitrary S
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Apple Safari - 'file://' Arbitrary Code Execution (Metasploit)
CVE-2011-3230—remoteosx17 out 2011
Apple Safari before 5.1.1 on Mac OS X does not enforce an intended policy for file: URLs, which allows remote attackers
50RISCO
abrir ↗
Metasploit600
Java RMI Server Insecure Default Configuration Java Code Execution
CVE-2011-3556—15 out 2011
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and ear
60RISCO
abrir ↗
Metasploit300
Java RMI Server Insecure Endpoint Code Execution Scanner
CVE-2011-3556—15 out 2011
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and ear
60RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
vTiger CRM 5.2 - 'onlyforuser' SQL Injection
CVE-2011-4559—webappsphp15 out 2011
SQL injection vulnerability in the Calendar module in vTiger CRM 5.2.1 and earlier allows remote attackers to execute ar
23RISCO
abrir ↗
Exploit-DB
Microsoft Windows - TCP/IP Stack Denial of Service (MS11-064)
CVE-2011-1965—doswindows15 out 2011
Tcpip.sys in the TCP/IP stack in Microsoft Windows 7 Gold and SP1 and Windows Server 2008 R2 and R2 SP1 does not properl
28RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Mozilla Firefox - 'Array.reduceRight()' Integer Overflow (Metasploit) (2)
CVE-2011-2371—remotewindows13 out 2011
Integer overflow in the Array.reduceRight method in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird bef
60RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Microsys PROMOTIC 8.1.4 - ActiveX GetPromoticSite Unitialized Pointer
CVE-2011-4518—doswindows13 out 2011
Directory traversal vulnerability in the PmWebDir object in the web server in MICROSYS PROMOTIC before 8.1.5 allows remo
28RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows - '.fon' Kernel-Mode Buffer Overrun (PoC) (MS11-077)
CVE-2011-2003—doswindows13 out 2011
Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, W
28RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Microsys PROMOTIC 8.1.4 - ActiveX GetPromoticSite Unitialized Pointer
CVE-2011-4520—doswindows13 out 2011
Heap-based buffer overflow in an ActiveX component in MICROSYS PROMOTIC before 8.1.5 allows remote attackers to cause a
23RISCO
abrir ↗
← anteriorpágina 1337 / 2.912próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.