Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
75.526exploits catalogados
34.478CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.443Referência 21.534GitHub PoC 13.654VulnCheck XDB 8.213Nuclei 4.218Metasploit 3.464✓ só verificadosrecentespopularesrisco
24.443 exploits
Exploit-DB✓ VexDay Proof
Caldera - '/costview2/printers.php?tr' SQL Injection
Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Adobe Flash Player - Integer Underflow Remote Code Execution (Metasploit)
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - NTUserMessageCall Win32k Kernel Pool Overflow 'schlamperei.x86.dll' (MS13-053) (Metasploit)
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, W
43RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Apache Struts - ClassLoader Manipulation Remote Code Execution (Metasploit)
CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict
45RISCO
abrir ↗Exploit-DB
F5 BIG-IQ 4.1.0.2013.0 - Privilege Escalation (Metasploit)
F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary u
28RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Apache Struts - ClassLoader Manipulation Remote Code Execution (Metasploit)
The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via t
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Apache Struts - ClassLoader Manipulation Remote Code Execution (Metasploit)
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which all
60RISCO
abrir ↗Exploit-DB
Fritz!Box - Remote Command Execution
AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter t
60RISCO
abrir ↗Exploit-DB
Beetel 450TC2 Router - Cross-Site Request Forgery (Admin Password)
Cross-site request forgery (CSRF) vulnerability in Beetel 450TC2 Router with firmware TX6-0Q-005_retail allows remote at
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Adobe Flash Player - Type Confusion Remote Code Execution (Metasploit)
Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2
60RISCO
abrir ↗Exploit-DB
McAfee ePolicy Orchestrator 4.6.0 < 4.6.5 - 'ePowner' Multiple Vulnerabilities
SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x b
23RISCO
abrir ↗Exploit-DB
WordPress Plugin iMember360 3.8.012 < 3.9.001 - Multiple Vulnerabilities
The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitr
23RISCO
abrir ↗Exploit-DB
NTP ntpd monlist Query Reflection - Denial of Service
The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service
60RISCO
abrir ↗Exploit-DB
GeoCore MAX DB Ver. 7.3.3 - Blind SQL Injection
Multiple SQL injection vulnerabilities in register.php in Geodesic Solutions GeoCore MAX 7.3.3 (formerly GeoClassifieds
23RISCO
abrir ↗Exploit-DB
WordPress Plugin iMember360 3.8.012 < 3.9.001 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow
23RISCO
abrir ↗Exploit-DB
WordPress Plugin iMember360 3.8.012 < 3.9.001 - Multiple Vulnerabilities
The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to o
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Wireshark 1.8.12/1.10.5 - wiretap/mpeg.c Stack Buffer Overflow (Metasploit)
Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10
50RISCO
abrir ↗Exploit-DB
WordPress Plugin iMember360 3.8.012 < 3.9.001 - Multiple Vulnerabilities
The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attac
23RISCO
abrir ↗Exploit-DB
WordPress Plugin iMember360 3.8.012 < 3.9.001 - Multiple Vulnerabilities
Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows re
23RISCO
abrir ↗Exploit-DB
GeoCore MAX DB Ver. 7.3.3 - Blind SQL Injection
SQL injection vulnerability in index.php in GeodesicSolutions (1) GeoAuctions Premier 2.0.3 and (2) GeoClassifieds Basic
23RISCO
abrir ↗Exploit-DB
Symantec Endpoint Protection Manager 12.1.x - Overflow (SEH) (PoC)
Buffer overflow in secars.dll in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1.x before 12.
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Kolibri Web Server 2.0 - GET Stack Buffer Overflow
Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a GET req
28RISCO
abrir ↗Exploit-DB
miSecureMessages 4.0.1 - Session Management / Authentication Bypass
AMTELCO miSecure Information Exposure
41RISCO
abrir ↗Exploit-DB✓ VexDay Proof
OpenSSL TLS Heartbeat Extension - 'Heartbleed' Information Leak (2) (DTLS Support)
20RISCO
abrir ↗Exploit-DB✓ VexDay Proof
OpenSSL TLS Heartbeat Extension - 'Heartbleed' Information Leak (2) (DTLS Support)
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RISCO
abrir ↗Exploit-DB
Acunetix 8 build 20120704 - Remote Stack Overflow
Stack-based buffer overflow in Acunetix Web Vulnerability Scanner (WVS) 8 build 20120704 allows remote attackers to exec
28RISCO
abrir ↗Exploit-DB✓ VexDay Proof
dompdf 0.6.0 - 'dompdf.php?read' Arbitrary File Read
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroo
50RISCO
abrir ↗Exploit-DB
WD Arkeia Virtual Appliance 10.2.9 - Local File Inclusion
Directory traversal vulnerability in opt/arkeia/wui/htdocs/index.php in the WD Arkeia virtual appliance (AVA) with firmw
23RISCO
abrir ↗Exploit-DB
HP Laser Jet - JavaScript Persistent Cross-Site Scripting via PJL Directory Traversal
The default configuration of the PJL Access value in the File System External Access settings on HP LaserJet MFP printer
28RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.