Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
89.426exploits catalogados
41.291CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.792Exploit-DB 24.491GitHub PoC 18.666inteligência de exploração 11.309Nuclei 4.626Metasploit 3.542✓ só verificadosrecentespopularesrisco
11.309 exploits
client-side
Git allows arbitrary code execution through broken config quoting
71RISCO
initial-access
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISCO
remote-with-credentials
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the
100RISCO
initial-access
RevPi Webstatus application is vulnerable to an authentication bypass
75RISCO
infoleak
ColdFusion | Improper Access Control (CWE-284)
100RISCO
initial-access
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISCO
initial-access
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle
100RISCO
client-side
Microsoft Outlook Remote Code Execution Vulnerability
41RISCO
local
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISCO
local
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISCO
remote-with-credentials
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the
100RISCO
local
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISCO
initial-access
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection o
100RISCO
initial-access
Argument Injection in PHP-CGI
100RISCO
local
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISCO
local
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISCO
infoleak
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISCO
client-side
Git allows arbitrary code execution through broken config quoting
71RISCO
infoleak
WP Fastest Cache < 1.2.2 - Unauthenticated SQL Injection
60RISCO
initial-access
Craft CMS Allows Remote Code Execution
100RISCO
initial-access
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISCO
remote-with-credentials
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute
60RISCO
infoleak
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISCO
infoleak
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISCO
local
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISCO
infoleak
DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input
68RISCO
infoleak
Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.
48RISCO
initial-access
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers'
85RISCO
infoleak
MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is resp
56RISCO
client-side
MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an e
63RISCO
Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e bases de inteligência de exploração. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.