Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
79.900exploits catalogados
36.847CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.475Referência 23.360GitHub PoC 15.228VulnCheck XDB 8.946Nuclei 4.390Metasploit 3.501✓ só verificadosrecentespopularesrisco
24.475 exploits
Exploit-DB
ProShow 9.0.3797 - Local Privilege Escalation
An issue was discovered in Photodex ProShow Producer v9.0.3797 (an application that runs with Administrator privileges).
23RISCO
abrir ↗Exploit-DB
UliCMS 2019.1 'Spitting Lama' - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitra
23RISCO
abrir ↗Exploit-DB
Microsoft Windows - AppX Deployment Service Local Privilege Escalation (3)
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard li
98RISCO
abrir ↗Exploit-DB
Supra Smart Cloud TV - 'openLiveURL()' Remote File Inclusion
Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcas
43RISCO
abrir ↗Exploit-DB
VMware WorkStation 12.5.3 - Virtual Machine Escape
VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi
23RISCO
abrir ↗Exploit-DB
Exim 4.87 < 4.91 - (Local / Remote) Command Execution
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message(
100RISCO
abrir ↗Exploit-DB
Zimbra < 8.8.11 - XML External Entity Injection / Server-Side Request Forgery
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x b
100RISCO
abrir ↗Exploit-DB✓ VexDay Proof
IBM Websphere Application Server - Network Deployment Untrusted Data Deserialization Remote Code Execution (Metasploit)
By default, BMC PATROL Agent through 11.3.01 uses a static encryption key for encrypting/decrypting user credentials sen
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
IBM Websphere Application Server - Network Deployment Untrusted Data Deserialization Remote Code Execution (Metasploit)
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with
85RISCO
abrir ↗Exploit-DB✓ VexDay Proof
LibreNMS - addhost Command Injection (Metasploit)
LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to htm
60RISCO
abrir ↗Exploit-DB
Zoho ManageEngine ServiceDesk Plus 9.3 - 'SiteLookup.do' Cross-Site Scripting
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field.
23RISCO
abrir ↗Exploit-DB
Zoho ManageEngine ServiceDesk Plus 9.3 - 'SolutionSearch.do' Cross-Site Scripting
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText par
23RISCO
abrir ↗Exploit-DB
Zoho ManageEngine ServiceDesk Plus 9.3 - 'SearchN.do' Cross-Site Scripting
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID paramete
23RISCO
abrir ↗Exploit-DB
Zoho ManageEngine ServiceDesk Plus 9.3 - 'PurchaseRequest.do' Cross-Site Scripting
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceReques
23RISCO
abrir ↗Exploit-DB
Cisco RV130W 1.0.3.44 - Remote Stack Overflow
Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
85RISCO
abrir ↗Exploit-DB
IceWarp 10.4.4 - Local File Inclusion
IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index
50RISCO
abrir ↗Exploit-DB
NUUO NVRMini 2 3.9.1 - 'sscanf' Stack Overflow
NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to execute arbitrary code or cause a
28RISCO
abrir ↗Exploit-DB
WordPress Plugin Form Maker 1.13.3 - SQL Injection
In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities
The Quest Kace K1000 Appliance is vulnerable to multiple Blind SQL Injections.
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities
The Quest Kace K1000 Appliance is vulnerable to JavaScript injection.
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities
The Quest Kace K1000 Appliance misconfigures the Cross-Origin Resource Sharing (CORS) mechanism.
28RISCO
abrir ↗Exploit-DB
Microsoft Windows Remote Desktop - 'BlueKeep' Denial of Service
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RISCO
abrir ↗Exploit-DB
pfSense 2.4.4-p3 (ACME Package 0.59_14) - Persistent Cross-Site Scripting
In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description fiel
35RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Spidermonkey - IonMonkey Leaks JS_OPTIMIZED_OUT Magic Value to Script
The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during
28RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Qualcomm Android - Kernel Use-After-Free via Incorrect set_page_dirty() in KGSL
Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function set
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Spidermonkey - IonMonkey Unexpected ObjectGroup in ObjectGroupDispatch Operation
A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, al
23RISCO
abrir ↗Exploit-DB
Petraware pTransformer ADC < 2.1.7.22827 - Login Bypass
Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form.
23RISCO
abrir ↗Exploit-DB
Deltek Maconomy 2.2.5 - Local File Inclusion
Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as
60RISCO
abrir ↗Exploit-DB
Typora 0.9.9.24.6 - Directory Traversal
Typora 0.9.9.24.6 on macOS allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substr
23RISCO
abrir ↗Exploit-DB
Microsoft Internet Explorer Windows 10 1809 17763.316 - Scripting Engine Memory Corruption
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet
93RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.