Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

86.388exploits catalogados
40.212CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.070Exploit-DB 24.488GitHub PoC 17.762VulnCheck XDB 9.990Nuclei 4.547Metasploit 3.531✓ só verificadosrecentespopularesrisco
86.388 exploits
GitHub PoC★ 2
Fully functional script for brute forcing SSH and trying credentials - CVE-2018-15473
CVE-2018-15473MEDIUM31 out 2018
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati
70RISCO
abrir ↗
GitHub PoC★ 10
CVE-2018-2628漏洞工具包
CVE-2018-2628CRITICALsob ataque30 out 2018
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S
100RISCO
abrir ↗
Exploit-DB
xorg-x11-server 1.20.3 - Privilege Escalation
CVE-2018-14665—localopenbsd30 out 2018
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh
43RISCO
abrir ↗
Exploit-DB
Microstrategy Web 7 - Cross-Site Scripting / Directory Traversal
CVE-2018-18776—webappsjsp30 out 2018
Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (
23RISCO
abrir ↗
Exploit-DB
Microstrategy Web 7 - Cross-Site Scripting / Directory Traversal
CVE-2018-18775—webappsjsp30 out 2018
Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (
38RISCO
abrir ↗
GitHub PoC
matlink/evince-cve-2017-1000083
CVE-2017-1000083—30 out 2018
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
50RISCO
abrir ↗
Exploit-DB
Microstrategy Web 7 - Cross-Site Scripting / Directory Traversal
CVE-2018-18777—webappsjsp30 out 2018
Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subp
43RISCO
abrir ↗
GitHub PoC
matlink/cve-2017-1000083-atril-nautilus
CVE-2017-1000083—30 out 2018
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
50RISCO
abrir ↗
Exploit-DB
ASRock Drivers - Privilege Escalation
CVE-2018-10712—doswindows29 out 2018
The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Str
23RISCO
abrir ↗
Exploit-DB
ASRock Drivers - Privilege Escalation
CVE-2018-10711—doswindows29 out 2018
The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Str
23RISCO
abrir ↗
Exploit-DB
School Event Management System 1.0 - SQL Injection
CVE-2018-18795—webappsphp29 out 2018
School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter.
23RISCO
abrir ↗
Exploit-DB
School Attendance Monitoring System 1.0 - SQL Injection
CVE-2018-18798—webappsphp29 out 2018
Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.ph
23RISCO
abrir ↗
Exploit-DB
Point of Sales (POS) in VB.Net MySQL Database 1.0 - SQL Injection
CVE-2018-18805—webappsphp29 out 2018
Point Of Sales 1.0 allows SQL injection via the login screen, related to LoginForm1.vb.
23RISCO
abrir ↗
Exploit-DB
RhinOS CMS 3.x - Arbitrary File Download
CVE-2018-18760—webappsphp29 out 2018
RhinOS 3.0 build 1190 allows CSRF.
23RISCO
abrir ↗
Exploit-DB
SaltOS Erp Crm 3.1 r8126 - SQL Injection (2)
CVE-2018-18763—webappsphp29 out 2018
SaltOS 3.1 r8126 allows action=ajax&query=numbers&page=usuarios&action2=[SQL] SQL Injection.
23RISCO
abrir ↗
Exploit-DB
SaltOS Erp Crm 3.1 r8126 - Database File Download
CVE-2018-18762—webappsphp29 out 2018
SaltOS 3.1 r8126 contains a database download vulnerability.
23RISCO
abrir ↗
Exploit-DB
School Event Management System 1.0 - Arbitrary File Upload
CVE-2018-18793—webappsphp29 out 2018
School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos.
23RISCO
abrir ↗
Exploit-DB
Modbus Slave 7.0.0 - Denial of Service (PoC)
CVE-2018-18759—doswindows29 out 2018
Modbus Slave 7.0.0 in modbus tools has a Buffer Overflow.
23RISCO
abrir ↗
Exploit-DB
ASRock Drivers - Privilege Escalation
CVE-2018-10710—doswindows29 out 2018
The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Str
23RISCO
abrir ↗
Exploit-DB
School Attendance Monitoring System 1.0 - Cross-Site Request Forgery (Update Admin)
CVE-2018-18797—webappsphp29 out 2018
School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.
23RISCO
abrir ↗
Exploit-DB
PayPal-Credit Card-Debit Card Payment 1.0 - SQL Injection
CVE-2018-18800—webappsphp29 out 2018
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=[SQL], index.php?p=
23RISCO
abrir ↗
Exploit-DB
K-iwi Framework 1775 - SQL Injection
CVE-2018-18755—webappsphp29 out 2018
K-iwi Framework 1775 has SQL Injection via the admin/user/group/update user_group_id parameter or the admin/user/user/up
23RISCO
abrir ↗
Exploit-DB
Curriculum Evaluation System 1.0 - SQL Injection
CVE-2018-18803—webappsphp29 out 2018
Curriculum Evaluation System 1.0 allows SQL Injection via the login screen, related to frmCourse.vb and includes/user.vb
23RISCO
abrir ↗
Exploit-DB
Bakeshop Inventory System in VB.Net and MS Access Database 1.0 - SQL Injection
CVE-2018-18804—webappsphp29 out 2018
Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb.
23RISCO
abrir ↗
Exploit-DB
School Attendance Monitoring System 1.0 - Arbitrary File Upload
CVE-2018-18799—webappsphp29 out 2018
School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos.
23RISCO
abrir ↗
Exploit-DB
ASRock Drivers - Privilege Escalation
CVE-2018-10709—doswindows29 out 2018
The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Str
23RISCO
abrir ↗
Exploit-DB
Paramiko 2.4.1 - Authentication Bypass
CVE-2018-7750—remotelinux29 out 2018
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x
28RISCO
abrir ↗
Exploit-DB
School Event Management System 1.0 - Cross-Site Request Forgery (Update Admin)
CVE-2018-18794—webappsphp29 out 2018
School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.
23RISCO
abrir ↗
Exploit-DB
SaltOS Erp Crm 3.1 r8126 - SQL Injection
CVE-2018-18761—webappsphp29 out 2018
SaltOS 3.1 r8126 allows action=login&querystring=&user=[SQL] SQL Injection.
28RISCO
abrir ↗
Exploit-DB
E-Negosyo System 1.0 - SQL Injection
CVE-2018-18801—webappsphp29 out 2018
The BSEN Ordering software 1.0 has SQL Injection via student/index.php?view=view&id=[SQL] or index.php?q=single-item&id=
23RISCO
abrir ↗
← anteriorpágina 995 / 2.880próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.