Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
89.220exploits catalogados
41.197CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.738Exploit-DB 24.490GitHub PoC 18.525inteligência de exploração 11.299Nuclei 4.626Metasploit 3.542✓ só verificadosrecentespopularesrisco
11.299 exploits
client-side
Microsoft Outlook Remote Code Execution Vulnerability
100RISCO
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
initial-access
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
98RISCO
initial-access
Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise
75RISCO
initial-access
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RISCO
initial-access
Craft CMS Allows Remote Code Execution
100RISCO
initial-access
Remote Code Execution in fastjson 1.2.68–1.2.83
48RISCO
remote-with-credentials
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
98RISCO
remote-with-credentials
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
98RISCO
initial-access
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISCO
local
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISCO
initial-access
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
75RISCO
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
initial-access
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISCO
initial-access
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
75RISCO
remote-with-credentials
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include pa
60RISCO
initial-access
Authentication Bypass in the SmartConsole Login Process Using an Application Token
93RISCO
initial-access
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISCO
info-leak
WooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File Read
56RISCO
initial-access
Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass
63RISCO
info-leak
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16
100RISCO
info-leak
TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR L
60RISCO
local
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
68RISCO
initial-access
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB be
60RISCO
local
Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects
71RISCO
initial-access
Authorization Bypass in Next.js Middleware
85RISCO
initial-access
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISCO
initial-access
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RISCO
Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e bases de inteligência de exploração. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.