Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
89.426exploits catalogados
41.291CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.792Exploit-DB 24.491GitHub PoC 18.666inteligência de exploração 11.309Nuclei 4.626Metasploit 3.542✓ só verificadosrecentespopularesrisco
11.309 exploits
initial-access
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISCO
initial-access
Authorization Bypass in Next.js Middleware
85RISCO
initial-access
Authorization Bypass in Next.js Middleware
85RISCO
initial-access
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISCO
initial-access
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISCO
initial-access
Authorization Bypass in Next.js Middleware
85RISCO
local
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISCO
initial-access
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISCO
initial-access
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. T
85RISCO
initial-access
Authorization Bypass in Next.js Middleware
85RISCO
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISCO
initial-access
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISCO
initial-access
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
85RISCO
remote-with-credentials
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri
100RISCO
initial-access
Craft CMS Allows Remote Code Execution
100RISCO
infoleak
Grafana path traversal
100RISCO
initial-access
Craft CMS Allows Remote Code Execution
100RISCO
initial-access
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion
100RISCO
initial-access
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISCO
initial-access
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISCO
initial-access
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion
100RISCO
initial-access
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISCO
initial-access
Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
60RISCO
client-side
NTLM Hash Disclosure Spoofing Vulnerability
75RISCO
initial-access
ingress-nginx admission controller RCE escalation
85RISCO
initial-access
ingress-nginx admission controller RCE escalation
85RISCO
initial-access
Craft CMS Allows Remote Code Execution
100RISCO
client-side
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISCO
infoleak
Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion
85RISCO
infoleak
Unauthenticated SQL Injection in graph_view.php in Cacti
85RISCO
Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e bases de inteligência de exploração. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.