Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
89.220exploits catalogados
41.197CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.738Exploit-DB 24.490GitHub PoC 18.525inteligência de exploração 11.299Nuclei 4.626Metasploit 3.542✓ só verificadosrecentespopularesrisco
11.299 exploits
initial-access
D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface
48RISCO
client-side
Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting
41RISCO
initial-access
Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
63RISCO
initial-access
Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present
60RISCO
local
Code Execution / Escalation of Privileges in ThrottleStop
41RISCO
initial-access
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISCO
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
initial-access
BIG-IP APM OAuth vulnerability
83RISCO
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
initial-access
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISCO
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
initial-access
pre-authentication remote code execution
98RISCO
info-leak
profanity through 1.60 has only four billion possible RNG initializations. Thus, attackers can recover private keys from
23RISCO
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
initial-access
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
78RISCO
initial-access
Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate
63RISCO
initial-access
Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
63RISCO
local
rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
78RISCO
initial-access
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RISCO
client-side
Microsoft Outlook Remote Code Execution Vulnerability
100RISCO
info-leak
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baske
48RISCO
initial-access
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISCO
initial-access
The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
48RISCO
Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e bases de inteligência de exploração. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.