Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
89.220exploits catalogados
41.197CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.738Exploit-DB 24.490GitHub PoC 18.525inteligência de exploração 11.299Nuclei 4.626Metasploit 3.542✓ só verificadosrecentespopularesrisco
11.299 exploits
initial-access
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISCO
initial-access
SSH user impersonation possible in Mikrotik RouterOS
48RISCO
initial-access
SSH user impersonation possible in Mikrotik RouterOS
48RISCO
info-leak
GLPI allows unauthenticated SQL injection through the inventory endpoint
78RISCO
initial-access
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RISCO
remote-with-credentials
Code Injection Vulnerability in Code Validation Endpoint
63RISCO
initial-access
XStore < 9.7.3 - Unauthenticated SQLi
56RISCO
remote-with-credentials
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISCO
initial-access
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISCO
initial-access
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp
100RISCO
initial-access
Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
63RISCO
initial-access
SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter
48RISCO
initial-access
Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
63RISCO
initial-access
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin
100RISCO
initial-access
PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation
78RISCO
initial-access
An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration a
56RISCO
remote-with-credentials
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
100RISCO
initial-access
Potential authentication bypass leading to administrative access in Artifactory
98RISCO
local
crypto: algif_aead - Revert to operating out-of-place
100RISCO
info-leak
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc
100RISCO
initial-access
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISCO
initial-access
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[
50RISCO
initial-access
Langflow - Path Traversal Arbitrary File Write via upload_user_file
68RISCO
initial-access
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISCO
initial-access
Potential authentication bypass leading to administrative access in Artifactory
98RISCO
initial-access
Langflow code Code Injection Remote Code Execution Vulnerability
68RISCO
initial-access
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISCO
initial-access
LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter
48RISCO
initial-access
Potential authentication bypass leading to administrative access in Artifactory
98RISCO
initial-access
Potential authentication bypass leading to administrative access in Artifactory
98RISCO
Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e bases de inteligência de exploração. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.