Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.768exploits catalogados

32.087CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 19.934GitHub PoC 13.235VulnCheck XDB 8.150Nuclei 4.201Metasploit 3.462✓ só verificadosrecentes populares risco

4.201 exploits

Nucleihigh

Palo Alto Expedition - SQL Injection

CVE-2024-9465CRITICALsob ataque

Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

100RISCO

abrir ↗

Nucleihigh

PAN-OS Management Web Interface - Command Injection

CVE-2024-9474MEDIUMsob ataqueransomware

PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

100RISCO

abrir ↗

Nucleihigh

Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Remote Code Execution

CVE-2024-9593HIGH

Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code Execution

61RISCO

abrir ↗

Nucleimedium

Danswer - Insecure Direct Object Reference

CVE-2024-9617MEDIUM

IDOR in danswer-ai/danswer

28RISCO

abrir ↗

Nucleicritical

Four-Faith F3x36 - Authentication Bypass

CVE-2024-9643CRITICAL

Four-Faith F3x36 Hidden Debug Credentials

43RISCO

abrir ↗

Nucleicritical

Hunk Companion <= 1.8.4 - Arbitrary Plugin Installation

CVE-2024-9707CRITICAL

Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation

63RISCO

abrir ↗

Nucleimedium

EKC Tournament Manager WordPress plugin - Path Traversal

CVE-2024-9765MEDIUM

EKC Tournament Manager < 2.2.2 - Local File Download Vulnerability

28RISCO

abrir ↗

Nucleihigh

WordPress UIX Shortcodes <= 1.9.7 - Unauthenticated Shortcode Execution

CVE-2024-9772HIGH

Uix Shortcodes – Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode Execution

36RISCO

abrir ↗

Nucleicritical

WordPress WP-Advanced-Search <= 3.3.9 - SQL Injection

CVE-2024-9796MEDIUM

WP-Advanced-Search < 3.3.9.2 - Unauthenticated SQL Injection

28RISCO

abrir ↗

Nucleihigh

HuangDou UTCMS V9 - OS Command Injection

CVE-2024-9916MEDIUM

HuangDou UTCMS cli.php os command injection

50RISCO

abrir ↗

Nucleihigh

PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Arbitrary File Download

CVE-2024-9935HIGH

PDF Generator Addon for Elementor Page Builder <= 2.0.0 - Unauthenticated Arbitrary File Download

36RISCO

abrir ↗

Nucleicritical

Crypto <= 2.15 - Authentication Bypass

CVE-2024-9989CRITICAL

Crypto <= 2.18 - Authentication Bypass via log_in

43RISCO

abrir ↗

Nucleicritical

Palo Alto Networks Expedition - OS Command Injection

CVE-2025-0107HIGH

Expedition: OS Command Injection Vulnerability

58RISCO

abrir ↗

Nucleicritical

PAN-OS Management Interface - Path Confusion to Authentication Bypass

CVE-2025-0108HIGHsob ataque

PAN-OS: Authentication Bypass in the Management Web Interface

100RISCO

abrir ↗

Nucleimedium

PAN-OS - Reflected Cross-Site Scripting

CVE-2025-0133LOW

PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and Portal

35RISCO

abrir ↗

Nucleicritical

WP Directory Kit <= 1.4.4 - Authentication Bypass

CVE-2025-13390CRITICAL

WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover

63RISCO

abrir ↗

Nucleimedium

Responsive Pricing Table <= 5.1.12 - Cross-Site Scripting

CVE-2025-13418MEDIUM

Responsive Pricing Table <= 5.1.12 - Authenticated (Author+) Stored Cross-Site Scripting

28RISCO

abrir ↗

Nucleicritical

Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution

CVE-2025-13486CRITICAL

Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form

85RISCO

abrir ↗

Nucleihigh

IP2Location Country Blocker < 2.38.9 - Unauthenticated Information Disclosure

CVE-2025-1361HIGH

IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function

36RISCO

abrir ↗

Nucleicritical

WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection

CVE-2025-13652MEDIUM

CBX Bookmark & Favorite <= 2.0.4 - Authenticated (Subscriber+) SQL Injection via `orderby` Parameter

28RISCO

abrir ↗

Nucleicritical

WordPress Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Remote Code Execution

CVE-2025-13773CRITICAL

Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Execution

43RISCO

abrir ↗

Nucleihigh

Yoco Payments <= 3.8.8 - Path Traversal

CVE-2025-13801HIGH

Yoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read

36RISCO

abrir ↗

Nucleimedium

WP Directory Kit < 1.5.0 - Unauthenticated Email Exposure

CVE-2025-13920MEDIUM

WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action

28RISCO

abrir ↗

Nucleimedium

LearnPress < 4.3.2 - Broken Access Control

CVE-2025-13956MEDIUM

LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure

28RISCO

abrir ↗

Nucleihigh

Team WordPress Plugin (TLP Team) <= 5.0.9 - SQL Injection

CVE-2025-14124HIGH

Team < 5.0.11 - Unauthenticated SQLi

36RISCO

abrir ↗

Nucleimedium

Premium Addons for Elementor - Unauthenticated Information Disclosure

CVE-2025-14155MEDIUM

Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'

28RISCO

abrir ↗

Nucleihigh

Payara Server - Cross-Site Scripting

CVE-2025-14340HIGH

Admin Account Takeover via malicious URL payload

36RISCO

abrir ↗

Nucleihigh

WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File

CVE-2025-14437HIGH

Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File

36RISCO

abrir ↗

Nucleihigh

D-Link DIR-803 - Authentication Bypass

CVE-2025-14528MEDIUM

D-Link DIR-803 Configuration getcfg.php information disclosure

28RISCO

abrir ↗

Nucleicritical

Gladinet CentreStack & Triofox - Hardcoded Credentials

CVE-2025-14611HIGHsob ataque

Gladinet CentreStack and TrioFox Hard Coded AES Keys

98RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.