Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
89.426exploits catalogados
41.291CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.792Exploit-DB 24.491GitHub PoC 18.666inteligência de exploração 11.309Nuclei 4.626Metasploit 3.542✓ só verificadosrecentespopularesrisco
11.309 exploits
remote-with-credentials
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
60RISCO
initial-access
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers'
85RISCO
initial-access
Authorization Bypass in Next.js Middleware
85RISCO
infoleak
SolarWinds Serv-U L Directory Transversal Vulnerability
100RISCO
infoleak
Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection
56RISCO
client-side
Microsoft Windows File Explorer Spoofing Vulnerability
38RISCO
initial-access
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISCO
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
client-side
Microsoft Windows File Explorer Spoofing Vulnerability
38RISCO
initial-access
Argument Injection in PHP-CGI
100RISCO
infoleak
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISCO
initial-access
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISCO
infoleak
File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read
56RISCO
initial-access
Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update
63RISCO
initial-access
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 thro
100RISCO
initial-access
Authorization Bypass in Next.js Middleware
85RISCO
client-side
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea
100RISCO
client-side
Microsoft Windows File Explorer Spoofing Vulnerability
38RISCO
initial-access
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7
100RISCO
initial-access
Remote Code Execution in DocsGPT
68RISCO
client-side
Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cro
33RISCO
initial-access
Authentication Bypass in GoAnywhere MFT
85RISCO
local
In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional
71RISCO
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISCO
client-side
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea
100RISCO
infoleak
Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion
85RISCO
initial-access
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle
100RISCO
local
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISCO
infoleak
The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote
60RISCO
initial-access
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
100RISCO
Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e bases de inteligência de exploração. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.