Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
86.186exploits catalogados
40.156CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.041Exploit-DB 24.488GitHub PoC 17.609VulnCheck XDB 9.976Nuclei 4.542Metasploit 3.530✓ só verificadosrecentespopularesrisco
86.186 exploits
Exploit-DB
Vembu Storegrid Web Interface 4.4.0 - Multiple Vulnerabilities
Vembu StoreGrid 4.4.x has XSS in interface/registercustomer/onlineregsuccess.php, interface/registerreseller/onlineregfa
23RISCO
abrir ↗Exploit-DB
Moodle 3.4.1 - Remote Code Execution
An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code exec
35RISCO
abrir ↗VulnCheck XDB
initial-access
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RISCO
abrir ↗GitHub PoC
The exploit python script for CVE-2018-7600
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISCO
abrir ↗Exploit-DB
Vembu Storegrid Web Interface 4.4.0 - Multiple Vulnerabilities
In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hid
23RISCO
abrir ↗GitHub PoC
cve-2019-9194
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
CMS Made Simple Showtime2 Module 3.6.2 - (Authenticated) Arbitrary File Upload
class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard
50RISCO
abrir ↗Exploit-DB
FTPGetter Standard 5.97.0.177 - Remote Code Execution
FTPGetter Standard v.5.97.0.177 allows remote code execution when a user initiates an FTP connection to an attacker-cont
50RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Apache Tika-server < 1.18 - Command Injection
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to
60RISCO
abrir ↗Exploit-DB✓ VexDay Proof
elFinder PHP Connector < 2.1.48 - 'exiftran' Command Injection (Metasploit)
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.
60RISCO
abrir ↗Metasploit600
Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XX
100RISCO
abrir ↗Metasploit600
Ruby On Rails DoubleTap Development Mode secret_key_base Vulnerability
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess th
60RISCO
abrir ↗Exploit-DB
pfSense 2.4.4-p1 (HAProxy Package 0.59_14) - Persistent Cross-Site Scripting
The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, re
35RISCO
abrir ↗Metasploit600
Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x b
100RISCO
abrir ↗Exploit-DB
Microsoft Windows MSHTML Engine - 'Edit' Remote Code Execution
A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML E
83RISCO
abrir ↗Exploit-DB
WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion
The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter.
50RISCO
abrir ↗Metasploit300
Microsoft Windows NtUserMNDragOver Local Privilege Elevation
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
98RISCO
abrir ↗GitHub PoC
Bits generated while analyzing CVE-2019-6340 Drupal RESTful RCE
Drupal core - Highly critical - Remote Code Execution
100RISCO
abrir ↗VulnCheck XDB
initial-access
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated use
85RISCO
abrir ↗GitHub PoC★ 16
CVE-2018-19276 - OpenMRS Insecure Object Deserialization RCE
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated use
85RISCO
abrir ↗Metasploit300
CMS Made Simple (CMSMS) Showtime2 File Upload RCE
class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard
50RISCO
abrir ↗Exploit-DB
Flexpaper PHP Publish Service 2.3.6 - Remote Code Execution
The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change_c
50RISCO
abrir ↗Exploit-DB
PRTG Network Monitor 18.2.38 - (Authenticated) Remote Code Execution
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administra
100RISCO
abrir ↗Metasploit300
Pimcore Unserialize RCE
An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/c
50RISCO
abrir ↗GitHub PoC
AeolusTF/CVE-2018-20250
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RISCO
abrir ↗Exploit-DB
Linux Kernel 4.4 (Ubuntu 16.04) - 'snd_timer_user_ccallback()' Kernel Pointer Leak
sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local us
23RISCO
abrir ↗VulnCheck XDB
client-side
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RISCO
abrir ↗VulnCheck XDB
initial-access
In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP
60RISCO
abrir ↗GitHub PoC★ 7
CVE-2018-20250-WINRAR-ACE Exploit with a UI
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RISCO
abrir ↗VulnCheck XDB
initial-access
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with
60RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.