Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
79.900exploits catalogados
36.847CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.475Referência 23.360GitHub PoC 15.228VulnCheck XDB 8.946Nuclei 4.390Metasploit 3.501✓ só verificadosrecentespopularesrisco
24.475 exploits
Exploit-DB✓ VexDay Proof
Microsoft Windows - 'FSCTL_FIND_FILES_BY_SID' Information Disclosure
An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vuln
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Solaris - RSH Stack Clash Privilege Escalation (Metasploit)
An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficie
38RISCO
abrir ↗Exploit-DB
Centos Web Panel 0.9.8.480 - Multiple Vulnerabilities
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter
23RISCO
abrir ↗Exploit-DB
Centos Web Panel 0.9.8.480 - Multiple Vulnerabilities
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/
60RISCO
abrir ↗Exploit-DB
Centos Web Panel 0.9.8.480 - Multiple Vulnerabilities
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/ind
28RISCO
abrir ↗Exploit-DB
NoMachine < 5.3.27 - Remote Code Execution
NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file lo
23RISCO
abrir ↗Exploit-DB
D-Link Routers - Directory Traversal
Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L t
50RISCO
abrir ↗Exploit-DB
D-Link Routers - Plaintext Password
An issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.
28RISCO
abrir ↗Exploit-DB
D-Link Routers - Command Injection
An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02
60RISCO
abrir ↗Exploit-DB
Phoenix Contact WebVisit 2985725 - Authentication Bypass
The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism i
28RISCO
abrir ↗Exploit-DB
SugarCRM 6.5.26 - Cross-Site Scripting
Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthentic
23RISCO
abrir ↗Exploit-DB
Phoenix Contact WebVisit 2985725 - Authentication Bypass
The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication.
28RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft SQL Server Management Studio 17.9 - '.xmla' XML External Entity Injection
An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious
28RISCO
abrir ↗Exploit-DB
Phoenix Contact WebVisit 6.40.00 - Password Disclosure
Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coinciden
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft SQL Server Management Studio 17.9 - '.xel' XML External Entity Injection
An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious
28RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft SQL Server Management Studio 17.9 - XML External Entity Injection
An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing malicious X
28RISCO
abrir ↗Exploit-DB✓ VexDay Proof
jQuery-File-Upload 9.22.0 - Arbitrary File Upload
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
60RISCO
abrir ↗Exploit-DB
Ektron CMS 9.20 SP2 - Improper Access Restrictions
Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote at
28RISCO
abrir ↗Exploit-DB
MicroTik RouterOS < 6.43rc3 - Remote Root
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
100RISCO
abrir ↗Exploit-DB
Seqrite End Point Security 7.4 - Privilege Escalation
Seqrite End Point Security v7.4 has "Everyone: (F)" permission for %PROGRAMFILES%\Seqrite\Seqrite, which allows local us
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
ifwatchd - Privilege Escalation (Metasploit)
/sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arb
38RISCO
abrir ↗Exploit-DB✓ VexDay Proof
ghostscript - executeonly Bypass with errorhandler Setup
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving err
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra JIT - 'BailOutOnInvalidatedArrayHeadSegment' Check Bypass
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
35RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra JIT - Type Confusion
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
35RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Delta Electronics Delta Industrial Automation COMMGR 1.08 - Stack Buffer Overflow (Metasploit)
Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPS
50RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Navigate CMS - (Unauthenticated) Remote Code Execution (Metasploit)
SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigat
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Zahir Enterprise Plus 6 - Stack Buffer Overflow (Metasploit)
Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute a
43RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Navigate CMS - (Unauthenticated) Remote Code Execution (Metasploit)
An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs N
60RISCO
abrir ↗Exploit-DB
net-snmp 5.7.3 - (Authenticated) Denial of Service (PoC)
The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnm
53RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Android - sdcardfs Changes current->fs Without Proper Locking
In sdcardfs_create and sdcardfs_mkdir of inode.c, there is a possible memory corruption due to improper locking. This co
23RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.