Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
89.340exploits catalogados
41.245CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.769Exploit-DB 24.491GitHub PoC 18.603inteligência de exploração 11.309Nuclei 4.626Metasploit 3.542✓ só verificadosrecentespopularesrisco
11.309 exploits
initial-access
REC in MCPJam inspector due to HTTP Endpoint exposes
75RISCO
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
initial-access
Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution
85RISCO
initial-access
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
60RISCO
denial-of-service
Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds m
71RISCO
remote-with-credentials
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
100RISCO
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
remote-with-credentials
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
100RISCO
remote-with-credentials
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
100RISCO
initial-access
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISCO
info-leak
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
85RISCO
initial-access
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca
60RISCO
initial-access
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
75RISCO
initial-access
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISCO
remote-with-credentials
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
100RISCO
remote-with-credentials
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
100RISCO
local
Libblockdev: lpe from allow_active to root in libblockdev via udisks
41RISCO
client-side
Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter
33RISCO
initial-access
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RISCO
info-leak
Unauthenticated log access in Twonky Server
75RISCO
initial-access
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
75RISCO
remote-with-credentials
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administra
100RISCO
info-leak
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc
100RISCO
denial-of-service
Redis Lua Use-After-Free may lead to remote code execution
85RISCO
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
local
On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlay
61RISCO
initial-access
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISCO
initial-access
Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
75RISCO
client-side
Microsoft Outlook Remote Code Execution Vulnerability
100RISCO
local
Windows Common Log File System Driver Elevation of Privilege Vulnerability
76RISCO
Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e bases de inteligência de exploração. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.