Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.858exploits catalogados

36.825CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.475Referência 23.346GitHub PoC 15.209VulnCheck XDB 8.944Nuclei 4.383Metasploit 3.501✓ só verificadosrecentes populares risco

3.501 exploits

Metasploit600

ProjectSend Arbitrary File Upload

CVE-2014-9567—02 dez 2014

Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows rem

50RISCO

abrir ↗

Metasploit300

ManageEngine NetFlow Analyzer Arbitrary File Download

CVE-2014-5445—30 nov 2014

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 a

60RISCO

abrir ↗

Metasploit600

Tuleap PHP Unserialize Code Execution

CVE-2014-8791—27 nov 2014

project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated

43RISCO

abrir ↗

Metasploit600

WordPress RevSlider File Upload and Execute Vulnerability

CVE-2014-9735—26 nov 2014

The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier

60RISCO

abrir ↗

Metasploit300

Adobe Flash Player PCRE Regex Vulnerability

CVE-2015-0318—25 nov 2014

Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442

60RISCO

abrir ↗

Metasploit300

Arris VAP2500 tools_command.php Command Execution

CVE-2014-8423—25 nov 2014

Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute ar

50RISCO

abrir ↗

Metasploit300

Arris VAP2500 tools_command.php Command Execution

CVE-2014-8424—25 nov 2014

ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authenticatio

50RISCO

abrir ↗

Metasploit300

WordPress Long Password DoS

CVE-2014-9016—20 nov 2014

The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x

60RISCO

abrir ↗

Metasploit300

Hikvision DVR RTSP Request Remote Code Execution

CVE-2014-4880—19 nov 2014

Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009, and other models and versions, allows remote atta

60RISCO

abrir ↗

Metasploit500

HP Performance Monitoring xglance Priv Esc

CVE-2014-2630—19 nov 2014

Unspecified vulnerability in HP Operations Agent 11.00, when Glance is used, allows local users to gain privileges via u

38RISCO

abrir ↗

Metasploit300

MS14-068 Microsoft Kerberos Checksum Validation Vulnerability

CVE-2014-6324HIGHsob ataque18 nov 2014

The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008

100RISCO

abrir ↗

Metasploit300

Cisco DLSw Information Disclosure Scanner

CVE-2014-7992—17 nov 2014

The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti

23RISCO

abrir ↗

Metasploit400

MS14-064 Microsoft Internet Explorer Windows OLE Automation Array Remote Code Execution

CVE-2014-6332HIGHsob ataque13 nov 2014

OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows

100RISCO

abrir ↗

Metasploit600

MS14-064 Microsoft Windows OLE Package Manager Code Execution Through Python

CVE-2014-6352HIGHsob ataque12 nov 2014

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2

100RISCO

abrir ↗

Metasploit200

MS14-070 Windows tcpip!SetAddrOptions NULL Pointer Dereference

CVE-2014-4076—11 nov 2014

Microsoft Windows Server 2003 SP2 allows local users to gain privileges via a crafted IOCTL call to (1) tcpip.sys or (2)

43RISCO

abrir ↗

Metasploit400

Adobe Flash Player UncompressViaZlibVariant Uninitialized Memory

CVE-2014-8440—11 nov 2014

Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on

60RISCO

abrir ↗

Metasploit600

WordPress Photo Gallery Unrestricted File Upload

CVE-2014-9312—11 nov 2014

Unrestricted File Upload vulnerability in Photo Gallery 1.2.5.

50RISCO

abrir ↗

Metasploit300

ManageEngine Password Manager SQLAdvancedALSearchResult.cc Pro SQL Injection

CVE-2014-8499—08 nov 2014

Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Servi

50RISCO

abrir ↗

Metasploit500

MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability

CVE-2014-7146—08 nov 2014

The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a cr

50RISCO

abrir ↗

Metasploit500

MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability

CVE-2014-8598—08 nov 2014

The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arb

50RISCO

abrir ↗

Metasploit300

i-FTP Schedule Buffer Overflow

CVE-2014-125114HIGH06 nov 2014

i-Ftp 2.20 Schedule.xml Stack-Based Buffer Overflow

36RISCO

abrir ↗

Metasploit300

ManageEngine Eventlog Analyzer Managed Hosts Administrator Credential Disclosure

CVE-2014-6039—05 nov 2014

ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed versio

50RISCO

abrir ↗

Metasploit300

ManageEngine Eventlog Analyzer Managed Hosts Administrator Credential Disclosure

CVE-2014-6038—05 nov 2014

Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerabili

60RISCO

abrir ↗

Metasploit600

Visual Mining NetCharts Server Remote Code Execution

CVE-2014-8516—03 nov 2014

Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary co

60RISCO

abrir ↗

Metasploit600

HP Data Protector 8.10 Remote Command Execution

CVE-2014-2623—02 nov 2014

Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown

60RISCO

abrir ↗

Metasploit600

tnftp "savefile" Arbitrary Command Execution

CVE-2014-8517—28 out 2014

The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 thro

50RISCO

abrir ↗

Metasploit300

GNU Wget FTP Symlink Arbitrary Filesystem Access

CVE-2014-4877—27 out 2014

Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to w

30RISCO

abrir ↗

Metasploit600

X7 Chat 2.0.5 lib/message.php preg_replace() PHP Code Execution

CVE-2014-8998—27 out 2014

lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a c

50RISCO

abrir ↗

Metasploit600

Wordpress Creative Contact Form Upload Vulnerability

CVE-2014-8739—22 out 2014

Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery

60RISCO

abrir ↗

Metasploit300

WildFly Directory Traversal

CVE-2014-7816—22 out 2014

Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.