Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

75.445exploits catalogados
34.432CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.443Referência 21.497GitHub PoC 13.627VulnCheck XDB 8.198Nuclei 4.217Metasploit 3.463✓ só verificadosrecentespopularesrisco
24.443 exploits
Exploit-DB
Cart Engine 3.0 - Multiple Vulnerabilities
CVE-2014-8305—webappsphp25 set 2014
Open redirect vulnerability in the redir function in includes/function.php in C97net Cart Engine before 4.0 allows remot
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
OSClass 3.4.1 - 'index.php' Local File Inclusion
CVE-2014-6308—webappsphp25 set 2014
Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot
43RISCO
abrir ↗
Exploit-DB
webEdition 6.3.8.0 (SVN-Revision: 6985) - Directory Traversal
CVE-2014-5258—webappsphp24 set 2014
Directory traversal vulnerability in showTempFile.php in webEdition CMS before 6.3.9.0 Beta allows remote authenticated
43RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Advantech Webaccess - dvs.ocx GetColor Buffer Overflow (Metasploit)
CVE-2014-2364—remotewindows24 set 2014
Advantech WebAccess Stack-Based Buffer Overflow
68RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
EMC AlphaStor Device Manager Opcode 0x75 - Command Injection (Metasploit)
CVE-2013-0928—remotewindows24 set 2014
The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote
50RISCO
abrir ↗
Exploit-DB
Restaurant Script (PizzaInn Project) - Persistent Cross-Site Scripting
CVE-2014-6619—webappsphp24 set 2014
Multiple cross-site scripting (XSS) vulnerabilities in register-exec.php in Restaurant Script (PizzaInn_Project) 1.0.0 a
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
LittleSite 0.1 - 'index.php' Local File Inclusion
CVE-2009-3542—webappsphp23 set 2014
Directory traversal vulnerability in ls.php in LittleSite (aka LS or LittleSite.php) 0.1 allows remote attackers to incl
23RISCO
abrir ↗
Exploit-DB
M/Monit 3.3.2 - Cross-Site Request Forgery
CVE-2014-6409—webappsphp20 set 2014
Cross-site request forgery (CSRF) vulnerability in M/Monit 3.3.2 and earlier allows remote attackers to hijack the authe
23RISCO
abrir ↗
Exploit-DB
M/Monit 3.3.2 - Cross-Site Request Forgery
CVE-2014-6607—webappsphp20 set 2014
M/Monit 3.3.2 and earlier does not verify the original password before changing passwords, which allows remote attackers
23RISCO
abrir ↗
Exploit-DB
ClassApps SelectSurvey.net - Multiple SQL Injections
CVE-2014-6030—webappsphp20 set 2014
Multiple SQL injection vulnerabilities in ClassApps SelectSurvey.NET before 4.125.002 allow (1) remote attackers to exec
23RISCO
abrir ↗
Exploit-DB
Livefyre LiveComments Plugin - Persistent Cross-Site Scripting
CVE-2014-6420—webappsphp20 set 2014
Cross-site scripting (XSS) vulnerability in Livefyre LiveComments 3.0 allows remote attackers to inject arbitrary web sc
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin Slideshow Gallery 1.4.6 - Arbitrary File Upload
CVE-2014-5460—webappsphp16 set 2014
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remot
60RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Aztech Modem Routers - Session Hijacking
CVE-2014-6436—remotehardware15 set 2014
Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices improperly manage sessions, which allows remote attackers to
35RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Railo 4.2.1 - Remote File Inclusion (Metasploit)
CVE-2014-5468—remotemultiple15 set 2014
A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cf
50RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Aztech Routers - '/cgi-bin/AZ_Retrain.cgi' Denial of Service
CVE-2014-6435—doshardware15 set 2014
cgi-bin/AZ_Retrain.cgi in Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices does not check for authentication,
28RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (1)
CVE-2014-6287CRITICALsob ataqueremotewindows15 set 2014
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
ManageEngine Eventlog Analyzer - Arbitrary File Upload (Metasploit)
CVE-2014-6037—remotemultiple15 set 2014
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8
60RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
Aztech Modem Routers - Information Disclosure
CVE-2014-6437—remotehardware15 set 2014
Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices allow remote attackers to obtain sensitive device configurat
28RISCO
abrir ↗
Exploit-DB
CacheGuard-OS 5.7.7 - Cross-Site Request Forgery
CVE-2014-4865—webappslinux15 set 2014
Cross-site request forgery (CSRF) vulnerability in gui/password-wadmin.apl in CacheGuard OS 5.7.7 allows remote attacker
23RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
ManageEngine Desktop Central StatusUpdate - Arbitrary File Upload (Metasploit)
CVE-2014-5005—remotewindows09 set 2014
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers
60RISCO
abrir ↗
Exploit-DB✓ VexDay Proof
ManageEngine Desktop Central StatusUpdate - Arbitrary File Upload (Metasploit)
CVE-2014-5006—remotewindows09 set 2014
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers
28RISCO
abrir ↗
Exploit-DB
phpMyFAQ 2.8.x - Multiple Vulnerabilities
CVE-2014-6050—webappsphp08 set 2014
phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request.
23RISCO
abrir ↗
Exploit-DB
phpMyFAQ 2.8.x - Multiple Vulnerabilities
CVE-2014-6049—webappsphp08 set 2014
phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted ins
23RISCO
abrir ↗
Exploit-DB
Mpay24 PrestaShop Payment Module 1.5 - Multiple Vulnerabilities
CVE-2014-2009—webappsphp08 set 2014
The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path
23RISCO
abrir ↗
Exploit-DB
phpMyFAQ 2.8.x - Multiple Vulnerabilities
CVE-2014-6046—webappsphp08 set 2014
Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack th
23RISCO
abrir ↗
Exploit-DB
phpMyFAQ 2.8.x - Multiple Vulnerabilities
CVE-2014-6048—webappsphp08 set 2014
phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request.
23RISCO
abrir ↗
Exploit-DB
phpMyFAQ 2.8.x - Multiple Vulnerabilities
CVE-2014-6047—webappsphp08 set 2014
phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by lever
23RISCO
abrir ↗
Exploit-DB
Mpay24 PrestaShop Payment Module 1.5 - Multiple Vulnerabilities
CVE-2014-2008—webappsphp08 set 2014
SQL injection vulnerability in confirm.php in the mPAY24 payment module before 1.6 for PrestaShop allows remote attacker
23RISCO
abrir ↗
Exploit-DB
phpMyFAQ 2.8.x - Multiple Vulnerabilities
CVE-2014-6045—webappsphp08 set 2014
SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to exec
23RISCO
abrir ↗
Exploit-DB
LoadedCommerce7 - Systemic Query Factory
CVE-2014-5140—webappsphp07 set 2014
The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly ha
23RISCO
abrir ↗
← anteriorpágina 217 / 815próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.