Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

86.388exploits catalogados

40.212CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.070Exploit-DB 24.488GitHub PoC 17.762VulnCheck XDB 9.990Nuclei 4.547Metasploit 3.531✓ só verificadosrecentes populares risco

86.388 exploits

GitHub PoC★ 4

个人整理的Centos7.x + Kubernetes-1.12.3 + Dashboard-1.8.3 无 CVE-2018-1002105 漏洞的master节点全自动快速一键安装部署文件，适用于测试环境，生产环境的快速安装部署

CVE-2018-1002105CRITICAL10 dez 2018

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upg

70RISCO

GitHub PoC★ 178

exp of CVE-2018-15982

CVE-2018-15982HIGHsob ataqueransomware10 dez 2018

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful

93RISCO

Metasploit600

ThinkPHP Multiple PHP Injection RCEs

CVE-2019-9082HIGHsob ataque10 dez 2018

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public/

100RISCO

Metasploit600

ThinkPHP Multiple PHP Injection RCEs

CVE-2018-20062CRITICALsob ataque10 dez 2018

An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP

100RISCO

Exploit-DB

Kubernetes - (Unauthenticated) Arbitrary Requests

CVE-2018-1002105CRITICALremotemultiple10 dez 2018

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upg

70RISCO

GitHub PoC★ 1

CVE-2014-0160

CVE-2014-0160HIGHsob ataque10 dez 2018

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISCO

GitHub PoC

Microsoft Equation 3.0/Convert python2 to python3

CVE-2017-11882HIGHsob ataqueransomware10 dez 2018

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi

100RISCO

Exploit-DB

Adiscon LogAnalyzer < 4.1.7 - Cross-Site Scripting

CVE-2018-19877—webappsphp09 dez 2018

login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field.

43RISCO

VulnCheck XDB

initial-access

CVE-2018-17431—08 dez 2018

Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication

60RISCO

Metasploit600

Cisco Prime Infrastructure Runrshell Privilege Escalation

CVE-2018-15439CRITICAL08 dez 2018

Cisco Small Business Switches Privileged Access Vulnerability

55RISCO

GitHub PoC★ 2

Proof of consept for CVE-2018-17431

CVE-2018-17431—08 dez 2018

Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication

60RISCO

GitHub PoC★ 13

CVE-2018-15982_PoC

CVE-2018-15982HIGHsob ataqueransomware06 dez 2018

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful

93RISCO

GitHub PoC★ 223

PoC for CVE-2018-1002105.

CVE-2018-1002105CRITICAL06 dez 2018

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upg

70RISCO

GitHub PoC★ 9

Unrestricted file upload in Adobe ColdFusion

CVE-2018-15961CRITICALsob ataque06 dez 2018

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr

100RISCO

VulnCheck XDB

initial-access

CVE-2018-15961CRITICALsob ataque06 dez 2018

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr

100RISCO

GitHub PoC

Flash sources for CVE-2018-15982 used by NK

CVE-2018-15982HIGHsob ataqueransomware05 dez 2018

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful

93RISCO

GitHub PoC

uzzzval/cve-2004-2167

CVE-2004-2167—05 dez 2018

Multiple buffer overflows in LaTeX2rtf 1.9.15, and possibly other versions, allow remote attackers to execute arbitrary

28RISCO

GitHub PoC★ 191

Test utility for cve-2018-1002105

CVE-2018-1002105CRITICAL05 dez 2018

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upg

70RISCO

Exploit-DB

DomainMOD 4.11.01 - Custom Domain Fields Cross-Site Scripting

CVE-2018-19750—webappsphp04 dez 2018

DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Doma

23RISCO

Exploit-DB

DomainMOD 4.11.01 - Registrar Cross-Site Scripting

CVE-2018-19752—webappsphp04 dez 2018

DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.

38RISCO

Exploit-DB

OpenSSH < 7.7 - User Enumeration (2)

CVE-2018-15473MEDIUMremotelinux04 dez 2018

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati

70RISCO

Exploit-DB

Xorg X11 Server (AIX) - Local Privilege Escalation

CVE-2018-14665—localaix04 dez 2018

A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh

43RISCO

Exploit-DB

NEC Univerge Sv9100 WebPro - 6.00 - Predictable Session ID / Clear Text Password Storage

CVE-2018-11741—webappshardware04 dez 2018

NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure vi

28RISCO

Exploit-DB✓ VexDay Proof

Microsoft Lync for Mac 2011 - Injection Forced Browsing/Download

CVE-2018-8474—doswindows04 dez 2018

A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messa

35RISCO

Exploit-DB

Rockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access Control Authentication Bypass

CVE-2018-19616—webappshardware04 dez 2018

An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/rem

35RISCO

Exploit-DB

Dolibarr ERP/CRM 8.0.3 - Cross-Site Scripting

CVE-2018-19799—webappsphp04 dez 2018

Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.

23RISCO

Exploit-DB

NEC Univerge Sv9100 WebPro - 6.00 - Predictable Session ID / Clear Text Password Storage

CVE-2018-11742—webappshardware04 dez 2018

NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI.

28RISCO

Exploit-DB

DomainMOD 4.11.01 - Owner name Field Cross-Site Scripting

CVE-2018-19749—webappsphp04 dez 2018

DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field.

38RISCO

Exploit-DB

NUUO NVRMini2 3.9.1 - (Authenticated) Command Injection

CVE-2018-15716—webappsphp04 dez 2018

NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. An attacker can send crafted reques

28RISCO

Exploit-DB

DomainMOD 4.11.01 - Custom SSL Fields Cross-Site Scripting

CVE-2018-19751—webappsphp04 dez 2018

DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields.

38RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.