Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
71.760exploits catalogados
32.083CVEs com exploração pública
1.932testados em laboratório
TodosExploit-DB 22.786Referência 19.934GitHub PoC 13.235VulnCheck XDB 8.150Nuclei 4.193Metasploit 3.462✓ só verificadosrecentespopularesrisco
4.193 exploits
Nucleihigh
Team WordPress Plugin (TLP Team) <= 5.0.9 - SQL Injection
Team < 5.0.11 - Unauthenticated SQLi
36RISCO
abrir ↗Nucleimedium
Premium Addons for Elementor - Unauthenticated Information Disclosure
Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'
28RISCO
abrir ↗Nucleihigh
Payara Server - Cross-Site Scripting
Admin Account Takeover via malicious URL payload
36RISCO
abrir ↗Nucleihigh
WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File
Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File
36RISCO
abrir ↗Nucleihigh
D-Link DIR-803 - Authentication Bypass
D-Link DIR-803 Configuration getcfg.php information disclosure
28RISCO
abrir ↗Nucleicritical
Gladinet CentreStack & Triofox - Hardcoded Credentials
Gladinet CentreStack and TrioFox Hard Coded AES Keys
98RISCO
abrir ↗Nucleimedium
WordPress Widgets for Social Photo Feed <= 1.8 - Information Disclosure
Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints
28RISCO
abrir ↗Nucleicritical
Sangfor OSM - Arbitrary File Upload
Sangfor Operation and Maintenance Management System common.jsp unrestricted upload
28RISCO
abrir ↗Nucleicritical
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation
63RISCO
abrir ↗Nucleimedium
EasyCVR <=2.1.2 - Information Disclosure
Anhui Xufan Information Technology EasyCVR getbaseconfig information disclosure
28RISCO
abrir ↗Nucleicritical
HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
75RISCO
abrir ↗Nucleicritical
Ingress-Nginx Controller - Remote Code Execution
ingress-nginx admission controller RCE escalation
85RISCO
abrir ↗Nucleicritical
WordPress JobWP Plugin <= 2.3.9 - SQL Injection
JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin <= 2.3.9 - Unauthenticated SQL Injection
36RISCO
abrir ↗Nucleihigh
Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection
Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter
68RISCO
abrir ↗Nucleicritical
Cisco IOS XE WLC - Arbitrary File Upload
A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client de
68RISCO
abrir ↗Nucleicritical
Cisco ISE - Remote Code Execution
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
100RISCO
abrir ↗Nucleimedium
Cisco Secure Firewall ASA & FTD - Authentication Bypass
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Softwar
100RISCO
abrir ↗Nucleimedium
Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
Yonyou UFIDA ERP-NC menu.jsp cross site scripting
28RISCO
abrir ↗Nucleimedium
Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
Yonyou UFIDA ERP-NC systop.jsp cross site scripting
28RISCO
abrir ↗Nucleimedium
Navidrome <=0.54.5 - Authentication Bypass in Subsonic API
Navidrome has authentication bypass in Subsonic API with non-existent username
28RISCO
abrir ↗Nucleimedium
Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
Yonyou UFIDA ERP-NC top.jsp cross site scripting
28RISCO
abrir ↗Nucleihigh
Joplin 3.3.3 Server - Privilege Escalation
Privilege escalation in Joplin server via user patch endpoint
36RISCO
abrir ↗Nucleimedium
Sitecore Experience Manager (XM)/Experience Platform (XP) 10.4 - Insecure Deserialization
Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through
60RISCO
abrir ↗Nucleicritical
TRUfusion Enterprise <= 7.10.4.0 - Path Traversal
TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, t
36RISCO
abrir ↗Nucleicritical
TRUfusion Enterprise <= 7.10.4.0 - Authentication Bypass
TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints s
36RISCO
abrir ↗Nucleihigh
TRUfusion Enterprise <= 7.10.4.0 - Admin Contact Portal
TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unau
41RISCO
abrir ↗Nucleicritical
Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0011)
Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass
100RISCO
abrir ↗Nucleicritical
Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)
Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass
100RISCO
abrir ↗Nucleimedium
Kentico Xperience CMS - Unauthenticated Stored XSS
Kentico Xperience stored cross-site scripting in multiple-file upload functionality
60RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.