Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
83.853exploits catalogados
39.383CVEs com exploração pública
24.695testados em laboratório
TodosReferência 25.447Exploit-DB 24.485GitHub PoC 16.269VulnCheck XDB 9.651Nuclei 4.478Metasploit 3.523✓ só verificadosrecentespopularesrisco
83.853 exploits
GitHub PoC★ 44
WordPress - Authenticated XXE (CVE-2021-29447)
WordPress Authenticated XXE attack when installation is running PHP 8
63RISCO
abrir ↗GitHub PoC
cve-2007-2447 this script was rewrite the part of Metasploit modules to python3
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands
50RISCO
abrir ↗VulnCheck XDB
local
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISCO
abrir ↗VulnCheck XDB
initial-access
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
100RISCO
abrir ↗GitHub PoC★ 3
my personal POC of CVE-2016-5195(dirtyCOW)
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISCO
abrir ↗Exploit-DB
Horde Groupware Webmail 5.2.22 - Stored XSS
An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library befor
23RISCO
abrir ↗Exploit-DB
Tileserver-gl 3.0.0 - 'key' Reflected Cross-Site Scripting (XSS)
An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected u
43RISCO
abrir ↗Exploit-DB
htmly 2.8.0 - 'description' Stored Cross-Site Scripting (XSS)
htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php.
23RISCO
abrir ↗GitHub PoC★ 63
CVE-2021-27928 MariaDB/MySQL-'wsrep provider' 命令注入漏洞
A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, a
35RISCO
abrir ↗Exploit-DB
jQuery 1.2 - Cross-Site Scripting (XSS)
jQuery has a potential XSS vulnerability
55RISCO
abrir ↗GitHub PoC
haotiku/CVE-2021-26855-exploit-Exchange
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISCO
abrir ↗Exploit-DB
CITSmart ITSM 9.1.2.27 - 'query' Time-based Blind SQL Injection (Authenticated)
CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete."
23RISCO
abrir ↗Exploit-DB
Genexis PLATINUM 4410 2.1 P4410-V2-1.28 - RCE
Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacter
35RISCO
abrir ↗GitHub PoC★ 176
[ProxyLogon] CVE-2021-26855 & CVE-2021-27065 Fixed RawIdentity Bug Exploit. [ProxyOracle] CVE-2021-31195 & CVE-2021-31196 Exploit Chains. [ProxyShell] CVE-2021-34473 & CVE-2021-34523 & CVE-2021-31207 Exploit Chains.
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISCO
abrir ↗Exploit-DB
MariaDB 10.2 - 'wsrep_provider' OS Command Execution
A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, a
35RISCO
abrir ↗Exploit-DB
CITSmart ITSM 9.1.2.22 - LDAP Injection
CITSmart before 9.1.2.23 allows LDAP Injection.
28RISCO
abrir ↗Metasploit600
GitLab Unauthenticated Remote ExifTool Command Injection
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validati
100RISCO
abrir ↗Metasploit600
GitLab Unauthenticated Remote ExifTool Command Injection
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec
100RISCO
abrir ↗Exploit-DB
jQuery 1.0.3 - Cross-Site Scripting (XSS)
Potential XSS vulnerability in jQuery
85RISCO
abrir ↗GitHub PoC
Malicious Payloads that abuses Win32k Elevation of Privilege Vulnerability (CVE-2021-28310)
Win32k Elevation of Privilege Vulnerability
71RISCO
abrir ↗VulnCheck XDB
initial-access
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISCO
abrir ↗VulnCheck XDB
local
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISCO
abrir ↗Exploit-DB
ExpressVPN VPN Router 1.0 - Router Login Panel's Integer Overflow
An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensi
28RISCO
abrir ↗VulnCheck XDB
infoleak
Apache Flink directory traversal attack: reading remote files through the REST API
100RISCO
abrir ↗GitHub PoC★ 1
Auto exploit RCE CVE-2020-5902
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic
100RISCO
abrir ↗Metasploit300
Cockpit CMS NoSQLi to RCE
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.
40RISCO
abrir ↗Metasploit300
Cockpit CMS NoSQLi to RCE
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.
60RISCO
abrir ↗GitHub PoC★ 1
CVE-2020-17519 Cheetah
Apache Flink directory traversal attack: reading remote files through the REST API
100RISCO
abrir ↗Metasploit0
Google Chrome versions before 89.0.4389.128 V8 XOR Typer Out-Of-Bounds Access RCE
Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to po
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.