Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.760exploits catalogados

32.083CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 19.934GitHub PoC 13.235VulnCheck XDB 8.150Nuclei 4.193Metasploit 3.462✓ só verificadosrecentes populares risco

4.193 exploits

Nucleicritical

NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution

CVE-2020-26919CRITICALsob ataque

NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.

85RISCO

abrir ↗

Nucleicritical

phpMyAdmin < 5.0.3 - SQL Injection

CVE-2020-26935—

An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerabili

30RISCO

abrir ↗

Nucleicritical

Emby < 4.5.0 - Server Server-Side Request Forgery

CVE-2020-26948—

Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.

40RISCO

abrir ↗

Nucleihigh

LionWiki <3.2.12 - Local File Inclusion

CVE-2020-27191—

LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted string in the ind

18RISCO

abrir ↗

Nucleicritical

JD Edwards EnterpriseOne Tools 9.2 - Information Disclosure

CVE-2020-2733CRITICAL

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics)

68RISCO

abrir ↗

Nucleihigh

Akkadian Provisioning Manager 4.50.02 - Sensitive Information Disclosure

CVE-2020-27361—

An issue exists within Akkadian Provisioning Manager 4.50.02 which allows attackers to view sensitive information within

18RISCO

abrir ↗

Nucleihigh

Processwire CMS <2.7.1 - Local File Inclusion

CVE-2020-27467—

A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.

23RISCO

abrir ↗

Nucleicritical

Good Layers LMS Plugin <= 2.1.4 - SQL Injection

CVE-2020-27481—

An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_no

23RISCO

abrir ↗

Nucleicritical

WordPress Loginizer < 1.6.4 – Unauthenticated SQL Injection via `log` Parameter

CVE-2020-27615—

The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_fa

30RISCO

abrir ↗

Nucleimedium

Wing FTP 6.4.4 - Cross-Site Scripting

CVE-2020-27735—

An XSS issue was discovered in Wing FTP 6.4.4. An arbitrary IFRAME element can be included in the help pages via a craft

18RISCO

abrir ↗

Nucleicritical

Wordpress Quiz and Survey Master <7.0.1 - Arbitrary File Deletion

CVE-2020-35951CRITICAL

An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbit

65RISCO

abrir ↗

Nucleimedium

Rukovoditel <= 2.7.2 - Cross Site Scripting

CVE-2020-35984—

A stored cross site scripting (XSS) vulnerability in the 'Users Alerts' feature of Rukovoditel 2.7.2 allows authenticate

18RISCO

abrir ↗

Nucleimedium

Rukovoditel <= 2.7.2 - Cross Site Scripting

CVE-2020-35985—

A stored cross site scripting (XSS) vulnerability in the 'Global Lists" feature of Rukovoditel 2.7.2 allows authenticate

18RISCO

abrir ↗

Nucleimedium

Rukovoditel <= 2.7.2 - Cross Site Scripting

CVE-2020-35986—

A stored cross site scripting (XSS) vulnerability in the 'Users Access Groups' feature of Rukovoditel 2.7.2 allows authe

18RISCO

abrir ↗

Nucleimedium

Rukovoditel <= 2.7.2 - Cross-Site Scripting

CVE-2020-35987—

A stored cross site scripting (XSS) vulnerability in the 'Entities List' feature of Rukovoditel 2.7.2 allows authenticat

18RISCO

abrir ↗

Nucleicritical

CSE Bookstore 1.0 - SQL Injection

CVE-2020-36112—

CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pub

23RISCO

abrir ↗

Nucleicritical

Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta

CVE-2020-36155CRITICAL

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalat

43RISCO

abrir ↗

Nucleimedium

Jira Server and Data Center - Information Disclosure

CVE-2020-36289MEDIUM

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Infor

50RISCO

abrir ↗

Nucleicritical

ThemeGrill Demo Importer < 1.6.2 - Database Reset

CVE-2020-36333—

themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a reset_wizard

18RISCO

abrir ↗

Nucleimedium

Smartstore <4.1.0 - Open Redirect

CVE-2020-36365—

Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication,

18RISCO

abrir ↗

Nucleimedium

WordPress 15Zine <3.3.0 - Cross-Site Scripting

CVE-2020-36510—

15Zine < 3.3.0 - Reflected Cross-Site Scripting

18RISCO

abrir ↗

Nucleicritical

Adning Advertising <= 1.5.5 - Arbitrary File Upload

CVE-2020-36705CRITICAL

Adning Advertising <= 1.5.5 - Arbitrary File Upload

43RISCO

abrir ↗

Nucleicritical

WordPress Epsilon Framework Themes <=2.4.8 - Remote Code Execution

CVE-2020-36708CRITICAL

Epsilon Framework Themes (Various Versions) - Function Injection

75RISCO

abrir ↗

Nucleicritical

ListingPro < 2.6.1 - Arbitrary Plugin Installation/Activation/Deactivation

CVE-2020-36719CRITICAL

ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Arbitrary Plugin Installation, Activation and Deactivation

43RISCO

abrir ↗

Nucleihigh

ListingPro < 2.6.1 - Sensitive Data Disclosure

CVE-2020-36723MEDIUM

ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information Disclosure

28RISCO

abrir ↗

Nucleimedium

WordPress Plugin Adning Advertising < 1.5.6 - Arbitrary File Upload

CVE-2020-36728MEDIUM

Adning Advertising <= 1.5.5 - Unauthenticated Arbitrary File Deletion via Path Traversal

28RISCO

abrir ↗

Nucleihigh

Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update

CVE-2020-36731HIGH

Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update

36RISCO

abrir ↗

Nucleihigh

WordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletion

CVE-2020-36836HIGH

WP Fastest Cache <= 0.9.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion

36RISCO

abrir ↗

Nucleimedium

BrightSign Digital Signage 8.2.26 - Server-Side Request Forgery

CVE-2020-36884MEDIUM

BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF

28RISCO

abrir ↗

Nucleicritical

Pinger 1.0 - Remote Code Execution

CVE-2020-37123CRITICAL

Pinger 1.0 - Remote Code Execution

63RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.