Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.820exploits catalogados

32.128CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 19.967GitHub PoC 13.254VulnCheck XDB 8.150Nuclei 4.201Metasploit 3.462✓ só verificadosrecentes populares risco

4.201 exploits

Nucleicritical

Revive Adserver 4.2 - Remote Code Execution

CVE-2019-5434—

An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() cal

50RISCO

abrir ↗

Nucleimedium

FortiOS - Insecure LDAP Configuration Detection

CVE-2019-5591MEDIUMsob ataque

A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept s

83RISCO

abrir ↗

Nucleimedium

WordPress Sell Media 2.4.1 - Cross-Site Scripting

CVE-2019-6112—

A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows

18RISCO

abrir ↗

Nucleihigh

Drupal - Remote Code Execution

CVE-2019-6340HIGHsob ataque

Drupal core - Highly critical - Remote Code Execution

100RISCO

abrir ↗

Nucleicritical

Total Donations Plugin for WordPress < 2.0.6 - Arbitrary Options Update

CVE-2019-6703—

Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for Wor

23RISCO

abrir ↗

Nucleihigh

W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated File Read / Directory Traversal

CVE-2019-6715—

pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via

23RISCO

abrir ↗

Nucleihigh

GitLab Enterprise Edition - Server-Side Request Forgery

CVE-2019-6793—

An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The

18RISCO

abrir ↗

Nucleimedium

phpMyAdmin <4.8.5 - Local File Inclusion

CVE-2019-6799—

An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true,

23RISCO

abrir ↗

Nucleimedium

Pypiserver <1.2.5 - Carriage Return Line Feed Injection

CVE-2019-6802—

CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS att

18RISCO

abrir ↗

Nucleicritical

Magento - SQL Injection

CVE-2019-7139—

An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which ca

43RISCO

abrir ↗

Nucleicritical

QNAP QTS and Photo Station 6.0.3 - Remote Command Execution

CVE-2019-7192CRITICALsob ataqueransomware

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix the

100RISCO

abrir ↗

Nucleicritical

QNAP Photo Station < 6.0.3 - Remote Code Execution

CVE-2019-7194CRITICALsob ataqueransomware

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fi

100RISCO

abrir ↗

Nucleicritical

QNAP Photo Station - Path Traversal

CVE-2019-7195CRITICALsob ataqueransomware

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fi

100RISCO

abrir ↗

Nucleimedium

Zarafa WebApp <=2.0.1.47791 - Cross-Site Scripting

CVE-2019-7219—

Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE: this is a di

18RISCO

abrir ↗

Nucleicritical

Sonatype Nexus Repository Manager <3.15.0 - Remote Code Execution

CVE-2019-7238CRITICALsob ataque

Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.

100RISCO

abrir ↗

Nucleihigh

eMerge E3 1.00-06 - Local File Inclusion

CVE-2019-7254—

Linear eMerge E3-Series devices allow File Inclusion.

60RISCO

abrir ↗

Nucleimedium

Linear eMerge E3 - Cross-Site Scripting

CVE-2019-7255—

Linear eMerge E3-Series devices allow XSS.

50RISCO

abrir ↗

Nucleicritical

eMerge E3 1.00-06 - Remote Code Execution

CVE-2019-7256CRITICALsob ataque

Linear eMerge E3-Series devices allow Command Injections.

100RISCO

abrir ↗

Nucleimedium

Optergy Proton/Enterprise Building Management System - Open Redirect

CVE-2019-7275—

Optergy Proton/Enterprise devices allow Open Redirect.

18RISCO

abrir ↗

Nucleicritical

Optergy Proton/Enterprise - Unauthenticated RCE via Backdoor Console

CVE-2019-7276—

Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console.

60RISCO

abrir ↗

Nucleihigh

Genie Access WIP3BVAF IP Camera - Local File Inclusion

CVE-2019-7315—

Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.x are vulnerable to directory traversal

23RISCO

abrir ↗

Nucleihigh

SonicWall SRA 4600 VPN - SQL Injection

CVE-2019-7481HIGHsob ataqueransomware

Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vu

88RISCO

abrir ↗

Nucleimedium

KindEditor 4.1.11 - Cross-Site Scripting

CVE-2019-7543—

In KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability.

18RISCO

abrir ↗

Nucleicritical

Kibana Timelion - Arbitrary Code Execution

CVE-2019-7609CRITICALsob ataque

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker

100RISCO

abrir ↗

Nucleihigh

Adobe Experience Manager - XML External Entity Injection

CVE-2019-8086—

Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful e

23RISCO

abrir ↗

Nucleimedium

qdPM 9.1 - Cross-site Scripting

CVE-2019-8390—

qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter.

38RISCO

abrir ↗

Nucleihigh

Jira - Local File Inclusion

CVE-2019-8442—

The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4,

30RISCO

abrir ↗

Nucleimedium

Jira Improper Authorization

CVE-2019-8446—

The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via

23RISCO

abrir ↗

Nucleimedium

Jira <8.4.0 - Information Disclosure

CVE-2019-8449—

The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate username

60RISCO

abrir ↗

Nucleimedium

Jira <8.4.0 - Server-Side Request Forgery

CVE-2019-8451—

The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the con

60RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.