Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
84.600exploits catalogados
39.734CVEs com exploração pública
24.695testados em laboratório
TodosReferência 25.742Exploit-DB 24.486GitHub PoC 16.618VulnCheck XDB 9.736Nuclei 4.493Metasploit 3.525✓ só verificadosrecentespopularesrisco
84.600 exploits
GitHub PoC★ 2
CVE-2017-17485:Jackson-databind RCE
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because o
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Druva inSync Windows Client 6.6.3 - Local Privilege Escalation
Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitra
38RISCO
abrir ↗VulnCheck XDB
remote-with-credentials
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to
60RISCO
abrir ↗Exploit-DB
OpenEDX platform Ironwood 2.5 - Remote Code Execution
Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>Ne
28RISCO
abrir ↗GitHub PoC★ 13
Checker for QNAP pre-auth root RCE (CVE-2019-7192 ~ CVE-2019-7195)
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix the
100RISCO
abrir ↗Metasploit600
Geutebruck testaction.cgi Remote Command Execution
Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code
30RISCO
abrir ↗GitHub PoC★ 45
PoC for CVE-2020-8617 (BIND)
A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
78RISCO
abrir ↗Exploit-DB
BIND - 'TSIG' Denial of Service
A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
78RISCO
abrir ↗Exploit-DB
Submitty 20.04.01 - Persistent Cross-Site Scripting
Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Pi-Hole - heisenbergCompensator Blocklist OS Command Execution (Metasploit)
The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abus
60RISCO
abrir ↗Metasploit300
BIND TSIG Badtime Query Denial of Service
A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
78RISCO
abrir ↗GitHub PoC★ 105
Cisco AnyConnect < 4.8.02042 privilege escalation through path traversal
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
83RISCO
abrir ↗VulnCheck XDB
initial-access
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RISCO
abrir ↗Exploit-DB
HP LinuxKI 6.01 - Remote Command Injection
LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.
60RISCO
abrir ↗Exploit-DB
Oracle Hospitality RES 3700 5.7 - Remote Code Execution
Vulnerability in the Oracle Hospitality RES 3700 component of Oracle Food and Beverage Applications. The supported versi
28RISCO
abrir ↗Exploit-DB
Mikrotik Router Monitoring System 1.2.3 - 'community' SQL Injection
An issue was discovered in Mikrotik-Router-Monitoring-System through 2018-10-22. SQL Injection exists in check_community
23RISCO
abrir ↗GitHub PoC★ 29
Tool to try multiple paths for PHPunit RCE CVE-2017-9841
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
100RISCO
abrir ↗VulnCheck XDB
initial-access
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.
100RISCO
abrir ↗GitHub PoC
yukar1z0e/CVE-2018-13379
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.
100RISCO
abrir ↗VulnCheck XDB
initial-access
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
100RISCO
abrir ↗VulnCheck XDB
client-side
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi
100RISCO
abrir ↗Metasploit600
LinuxKI Toolset 6.01 Remote Command Execution
LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.
60RISCO
abrir ↗VulnCheck XDB
local
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow
93RISCO
abrir ↗VulnCheck XDB
infoleak
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUp
100RISCO
abrir ↗GitHub PoC
TelerikUI Vulnerability Scanner (CVE-2019-18935)
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUp
100RISCO
abrir ↗GitHub PoC★ 89
Weblogic Vuln POC EXP cve-2020-2551 cve-2020-2555 cve-2020-2883 ，。。。
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Suppor
100RISCO
abrir ↗VulnCheck XDB
initial-access
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions th
100RISCO
abrir ↗GitHub PoC
cdedmondson/Modified-CVE-2015-3306-Exploit
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and
100RISCO
abrir ↗GitHub PoC
PoC for CVE-2020-3153 Cisco AnyConnect Secure Mobility Client EoP
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
83RISCO
abrir ↗Metasploit600
Plesk/myLittleAdmin ViewState .NET Deserialization
The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcod
60RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.