Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

84.035exploits catalogados

39.531CVEs com exploração pública

24.695testados em laboratório

Todos Referência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9.678Nuclei 4.478Metasploit 3.524✓ só verificadosrecentes populares risco

84.035 exploits

GitHub PoC★ 1

Apache Struts2框架是一个用于开发Java EE网络应用程序的Web框架。Apache Struts于2020年12月08日披露 S2-061 Struts 远程代码执行漏洞（CVE-2020-17530），在使用某些tag等情况下可能存在OGNL表达式注入漏洞，从而造成远程代码执行，风险极大。提醒我校Apache Struts用户尽快采取安全措施阻止漏洞攻击。

CVE-2020-17530CRITICALsob ataque09 dez 2020

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected

100RISCO

GitHub PoC★ 64

ka1n4t/CVE-2020-17530

CVE-2020-17530CRITICALsob ataque09 dez 2020

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected

100RISCO

GitHub PoC★ 157

weaponized tool for CVE-2020-17144

CVE-2020-17144HIGHsob ataque09 dez 2020

Microsoft Exchange Remote Code Execution Vulnerability

83RISCO

GitHub PoC★ 157

Exchange2010 authorized RCE

CVE-2020-17144HIGHsob ataque09 dez 2020

Microsoft Exchange Remote Code Execution Vulnerability

83RISCO

GitHub PoC

WildfootW/CVE-2018-15473_OpenSSH_7.7

CVE-2018-15473MEDIUM09 dez 2020

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati

70RISCO

VulnCheck XDB

infoleak

CVE-2020-0796CRITICALsob ataqueransomware08 dez 2020

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

100RISCO

VulnCheck XDB

denial-of-service

CVE-2020-0796CRITICALsob ataqueransomware08 dez 2020

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

100RISCO

GitHub PoC

Remote code execution in Mediawiki Score

CVE-2020-29007CRITICAL08 dez 2020

The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of

48RISCO

VulnCheck XDB

local

CVE-2020-0796CRITICALsob ataqueransomware08 dez 2020

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

100RISCO

VulnCheck XDB

remote-with-credentials

CVE-2019-2618—08 dez 2020

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S

35RISCO

VulnCheck XDB

infoleak

CVE-2020-1472MEDIUMsob ataqueransomware08 dez 2020

Netlogon Elevation of Privilege Vulnerability

100RISCO

VulnCheck XDB

initial-access

CVE-2020-7961CRITICALsob ataque08 dez 2020

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c

100RISCO

Metasploit600

APISIX Admin API default access token RCE

CVE-2020-13945—07 dez 2020

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the

40RISCO

Metasploit600

APISIX Admin API default access token RCE

CVE-2022-24112CRITICALsob ataque07 dez 2020

apisix/batch-requests plugin allows overwriting the X-REAL-IP header

100RISCO

Exploit-DB

Druva inSync Windows Client 6.6.3 - Local Privilege Escalation (PowerShell)

CVE-2020-5752—localwindows07 dez 2020

Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitra

38RISCO

VulnCheck XDB

initial-access

CVE-2017-5638CRITICALsob ataqueransomware06 dez 2020

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

100RISCO

GitHub PoC★ 1

PoC for CVE: 2017-5638 - Apache Struts2 S2-045

CVE-2017-5638CRITICALsob ataqueransomware06 dez 2020

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

100RISCO

Metasploit300

WordPress Easy WP SMTP Password Reset

CVE-2020-35234—06 dez 2020

The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in De

30RISCO

GitHub PoC

Exploit for the vulnerability CVE-2007-2447

CVE-2007-2447—06 dez 2020

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands

50RISCO

GitHub PoC

[qdPM < 9.1 - Remote Code Execution](https://www.exploit-db.com/exploits/48146)

CVE-2020-7246—05 dez 2020

A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code

60RISCO

Exploit-DB

Wordpress Plugin Canto 1.3.0 - Blind SSRF (Unauthenticated)

CVE-2020-28978—webappsmultiple04 dez 2020

The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a

28RISCO

Exploit-DB

Chromium 83 - Full CSP Bypass

CVE-2020-6519—localmultiple04 dez 2020

Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy

28RISCO

GitHub PoC★ 14

This small script helps to avoid using MetaSploit (msfconsole) during the Enterprise pentests and OSCP-like exams. Grep included function will help you to get only the important information.

CVE-2006-3392—04 dez 2020

Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote

60RISCO

Exploit-DB

Wordpress Plugin Canto 1.3.0 - Blind SSRF (Unauthenticated)

CVE-2020-28976—webappsmultiple04 dez 2020

The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make

43RISCO

Exploit-DB

Wordpress Plugin Canto 1.3.0 - Blind SSRF (Unauthenticated)

CVE-2020-28977—webappsmultiple04 dez 2020

The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a

28RISCO

GitHub PoC

diegojuan/CVE-2019-15107

CVE-2019-15107CRITICALsob ataqueransomware03 dez 2020

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RISCO

GitHub PoC★ 1

Scan through given ip list

CVE-2019-0708CRITICALsob ataqueransomware03 dez 2020

A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau

100RISCO

GitHub PoC

ActorExpose/CVE-2017-11882

CVE-2017-11882HIGHsob ataqueransomware03 dez 2020

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi

100RISCO

VulnCheck XDB

initial-access

CVE-2019-15107CRITICALsob ataqueransomware03 dez 2020

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RISCO

Exploit-DB

Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality

CVE-2020-27423—webappsphp02 dez 2020

Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial o

23RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.