Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
71.760exploits catalogados
32.083CVEs com exploração pública
1.932testados em laboratório
TodosExploit-DB 22.786Referência 19.934GitHub PoC 13.235VulnCheck XDB 8.150Nuclei 4.193Metasploit 3.462✓ só verificadosrecentespopularesrisco
4.193 exploits
Nucleimedium
Piwigo - User Enumeration via Password Reset
Piwigo Vulnerable to User Enumeration via Password Reset Endpoint
28RISCO
abrir ↗Nucleimedium
Vite - Information Disclosure
vite allows server.fs.deny bypass via backslash on Windows
28RISCO
abrir ↗Nucleimedium
VDO.Ninja - DOM-Based Cross-Site Scripting
VDO.Ninja Reflected XSS Vulnerability in control.html
28RISCO
abrir ↗Nucleimedium
ChangeDetection.io <= v0.50.33 - Stored XSS via Watch API
changedetection.io vulnerable to stored XSS in Watch update via API
23RISCO
abrir ↗Nucleimedium
Dify v1.9.1 - Broken Access Control
Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to th
41RISCO
abrir ↗Nucleicritical
Code-Projects School Fees Payment System 1.0 - SQL Injection
code-projects School Fees Payment System student.php sql injection
28RISCO
abrir ↗Nucleicritical
DNN - Unrestricted Arbitrary File Upload
DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
75RISCO
abrir ↗Nucleicritical
FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection
FreePBX Administration GUI is Vulnerable to Authenticated Command Injection
100RISCO
abrir ↗Nucleicritical
FortiWeb - Authentication Bypass
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb
100RISCO
abrir ↗Nucleihigh
Symfony HttpFoundation - Access Control Bypass via PATH_INFO
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
36RISCO
abrir ↗Nucleimedium
Astro - Broken Access Control
Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass
28RISCO
abrir ↗Nucleihigh
Astro - Reflected XSS via server islands feature
Astro is vulnerable to Reflected XSS via the server islands feature
36RISCO
abrir ↗Nucleimedium
XWiki DeleteApplication - Cross-Site Scripting
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
28RISCO
abrir ↗Nucleihigh
Apache Tika - XML External Entity Injection
Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected
58RISCO
abrir ↗Nucleihigh
Yonyou YonBIP - Path Traversal
In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to
36RISCO
abrir ↗Nucleicritical
ComfyUI-Manager < 3.38 - Configuration Overwrite
An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration a
36RISCO
abrir ↗Nucleihigh
LottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization
WordPress LottieFiles plugin <= 3.0.0 - Broken Access Control vulnerability
36RISCO
abrir ↗Nucleimedium
User Submitted Posts <= 20251121 - Unauthenticated Open Redirect
WordPress User Submitted Posts plugin <= 20251121 - Open Redirection vulnerability
28RISCO
abrir ↗Nucleihigh
WordPress Broken Link Notifier < 1.3.1 - Unauthenticated SSRF
Broken Link Notifier <= 1.3.0 - Unauthenticated Server-Side Request Forgery
36RISCO
abrir ↗Nucleimedium
Accept Donations with PayPal <= 1.5.2 - Open Redirect
WordPress Accept Donations with PayPal plugin <= 1.5.2 - Open Redirection vulnerability
28RISCO
abrir ↗Nucleicritical
n8n - Remote Code Execution via Expression Injection
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISCO
abrir ↗Nucleihigh
Zimbra Collaboration - Local File Inclusion
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1
98RISCO
abrir ↗Nucleihigh
phpMyFAQ - Configuration Backup Disclosure
phpMyFAQ has unauthenticated config backup download via /api/setup/backup
36RISCO
abrir ↗Nucleicritical
The Opal Estate Pro – Property Management <= 1.7.5 - Unauthenticated Privilege Escalation
Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'
68RISCO
abrir ↗Nucleihigh
ionCube Tester Plus <= 1.3 - Local File Inclusion
WordPress ionCube tester plus plugin <= 1.3 - Arbitrary File Download vulnerability
36RISCO
abrir ↗Nucleicritical
WordPress Events Manager <= 7.0.3 - SQL Injection
Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter
48RISCO
abrir ↗Nucleihigh
WP Responsive Images <= 1.0 - Arbitrary File Read
WP Responsive Images <= 1.0 - Unauthenticated Path Traversal to Arbitrary File Read via src
36RISCO
abrir ↗Nucleicritical
wpForo Forum <= 2.4.14 - SQL Injection
wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection
56RISCO
abrir ↗Nucleihigh
Ivanti Endpoint Manager - Authentication Bypass
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to
88RISCO
abrir ↗Nucleimedium
LeadConnector < 3.0.22 - Unauthenticated Arbitrary Data Write
LeadConnector < 3.0.22 - Unauthenticated Rest Call
28RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.