Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

83.780exploits catalogados

39.319CVEs com exploração pública

24.695testados em laboratório

Todos Referência 25.394Exploit-DB 24.485GitHub PoC 16.249VulnCheck XDB 9.651Nuclei 4.478Metasploit 3.523✓ só verificadosrecentes populares risco

83.780 exploits

GitHub PoC★ 71

This demonstration video shows how we can control the victim's device by sending the innocent-looking PDF file to the target which actually consists of embedded payload. The exploit was made public as CVE-2010-1240.

CVE-2010-1240—05 jun 2021

Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of

60RISCO

VulnCheck XDB

remote-with-credentials

CVE-2021-22911—05 jun 2021

A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti

60RISCO

VulnCheck XDB

initial-access

CVE-2018-7600CRITICALsob ataqueransomware05 jun 2021

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RISCO

VulnCheck XDB

initial-access

CVE-2021-22205CRITICALsob ataqueransomware05 jun 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validati

100RISCO

GitHub PoC★ 2

CVE-2021-21985 vmware 6.7-9.8 RCE

CVE-2021-21985CRITICALsob ataqueransomware04 jun 2021

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual

100RISCO

Exploit-DB

Monstra CMS 3.0.4 - Remote Code Execution (Authenticated)

CVE-2018-6383—webappsphp04 jun 2021

Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but

28RISCO

VulnCheck XDB

initial-access

CVE-2021-21985CRITICALsob ataqueransomware04 jun 2021

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual

100RISCO

Exploit-DB

FUDForum 3.1.0 - 'srch' Reflected XSS

CVE-2021-27519—webappsphp03 jun 2021

A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "

38RISCO

VulnCheck XDB

initial-access

CVE-2021-21985CRITICALsob ataqueransomware03 jun 2021

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual

100RISCO

Exploit-DB

4Images 1.8 - 'redirect' Reflected XSS

CVE-2021-27308—webappsphp03 jun 2021

A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to in

23RISCO

VulnCheck XDB

initial-access

CVE-2020-24949—03 jun 2021

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a cr

50RISCO

Exploit-DB

CHIYU IoT Devices - Denial of Service (DoS)

CVE-2021-31642—webappshardware03 jun 2021

A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including B

35RISCO

GitHub PoC

PHPFusion 9.03.50 - Remote Code Execution

CVE-2020-24949—03 jun 2021

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a cr

50RISCO

Exploit-DB

CHIYU IoT Devices - 'Telnet' Authentication Bypass

CVE-2021-31251—remotehardware03 jun 2021

An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Tec

35RISCO

Exploit-DB

FUDForum 3.1.0 - 'author' Reflected XSS

CVE-2021-27520—webappsphp03 jun 2021

A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "

38RISCO

Exploit-DB

Seo Panel 4.8.0 - 'from_time' Reflected XSS

CVE-2021-28420—webappsphp03 jun 2021

A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and th

23RISCO

GitHub PoC★ 115

cve-2021-21985 exploit

CVE-2021-21985CRITICALsob ataqueransomware03 jun 2021

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual

100RISCO

Metasploit600

Polkit D-Bus Authentication Bypass

CVE-2021-3560HIGHsob ataque03 jun 2021

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile

91RISCO

GitHub PoC★ 23

An extended proof-of-concept for the CVE-2021-21551 Dell ‘dbutil_2_3.sys’ Kernel Exploit

CVE-2021-21551HIGHsob ataque02 jun 2021

Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile

100RISCO

Exploit-DB

Seo Panel 4.8.0 - 'search_name' Reflected XSS

CVE-2021-28417—webappsphp02 jun 2021

A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and t

23RISCO

GitHub PoC★ 9

bluefrostsecurity/CVE-2021-28476

CVE-2021-28476CRITICAL02 jun 2021

Windows Hyper-V Remote Code Execution Vulnerability

60RISCO

Exploit-DB

Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution

CVE-2020-11978HIGHsob ataquewebappsmultiple02 jun 2021

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was disco

100RISCO

VulnCheck XDB

local

CVE-2021-21551HIGHsob ataque02 jun 2021

Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile

100RISCO

Exploit-DB

Products.PluggableAuthService 2.6.0 - Open Redirect

CVE-2021-21337MEDIUMwebappspython02 jun 2021

URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService

33RISCO

Exploit-DB

Seo Panel 4.8.0 - 'category' Reflected XSS

CVE-2021-28418—webappsphp02 jun 2021

A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and

23RISCO

VulnCheck XDB

initial-access

CVE-2020-7247CRITICALsob ataque02 jun 2021

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to

100RISCO

GitHub PoC

This vulnerability exists in OpenBSD’s mail server OpenSMTPD’s “smtp_mailaddr()” function, and affects OpenBSD version 6.6. This allows an attacker to execute arbitrary shell commands like “sleep 66” as root user

CVE-2020-7247CRITICALsob ataque02 jun 2021

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to

100RISCO

Exploit-DB

Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution

CVE-2020-13927CRITICALsob ataquewebappsmultiple02 jun 2021

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but th

100RISCO

GitHub PoC

LogonTracer v1.2.0 RCE

CVE-2018-16167—02 jun 2021

LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.

60RISCO

Exploit-DB

GetSimple CMS 3.3.4 - Information Disclosure

CVE-2014-8722—webappsphp02 jun 2021

GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<user

28RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.