Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
86.388exploits catalogados
40.212CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.070Exploit-DB 24.488GitHub PoC 17.762VulnCheck XDB 9.990Nuclei 4.547Metasploit 3.531✓ só verificadosrecentespopularesrisco
86.388 exploits
Exploit-DB
School Event Management System 1.0 - Cross-Site Request Forgery (Update Admin)
School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.
23RISCO
abrir ↗Exploit-DB
SaltOS Erp Crm 3.1 r8126 - SQL Injection (2)
SaltOS 3.1 r8126 allows action=ajax&query=numbers&page=usuarios&action2=[SQL] SQL Injection.
23RISCO
abrir ↗Exploit-DB
School Attendance Monitoring System 1.0 - Arbitrary File Upload
School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos.
23RISCO
abrir ↗GitHub PoC★ 4
Exploit for vulnerability CVE-2018-6389 on wordpress sites
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the
45RISCO
abrir ↗VulnCheck XDB
local
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh
43RISCO
abrir ↗GitHub PoC★ 17
OpenBsd_CVE-2018-14665
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh
43RISCO
abrir ↗Exploit-DB
xorg-x11-server < 1.20.3 - Local Privilege Escalation
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh
43RISCO
abrir ↗Exploit-DB✓ VexDay Proof
WebExec - (Authenticated) User Code Execution (Metasploit)
Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability
61RISCO
abrir ↗Exploit-DB
AjentiCP 1.2.23.13 - Cross-Site Scripting
ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in Fi
23RISCO
abrir ↗GitHub PoC★ 14
CVE-2018-3245
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S
45RISCO
abrir ↗Exploit-DB
Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass)
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S
45RISCO
abrir ↗Metasploit400
Xorg X11 Server SUID logfile Privilege Escalation
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh
43RISCO
abrir ↗Metasploit500
Xorg X11 Server Local Privilege Escalation
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh
43RISCO
abrir ↗Metasploit400
Xorg X11 Server SUID modulepath Privilege Escalation
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh
43RISCO
abrir ↗GitHub PoC
ensimag-security/CVE-2018-10933
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul
85RISCO
abrir ↗Exploit-DB✓ VexDay Proof
libtiff 4.0.9 - Decodes Arbitrarily Sized JBIG into a Target Buffer
LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3
28RISCO
abrir ↗Exploit-DB✓ VexDay Proof
WebEx - Local Service Permissions Exploit (Metasploit)
Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability
61RISCO
abrir ↗Exploit-DB
Ekushey Project Manager CRM 3.1 - Cross-Site Scripting
In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as d
23RISCO
abrir ↗Exploit-DB
User Management 1.1 - Cross-Site Scripting
Stored XSS has been discovered in the upload section of ARDAWAN.COM User Management 1.1, as demonstrated by a .jpg filen
23RISCO
abrir ↗Exploit-DB
Adult Filter 1.0 - Buffer Overflow (SEH)
Adult Filter 1.0 has a Buffer Overflow via a crafted Black Domain List file.
23RISCO
abrir ↗Exploit-DB
ProjeQtOr Project Management Tool 7.2.5 - Remote Code Execution
The image-upload feature in ProjeQtOr 7.2.5 allows remote attackers to execute arbitrary code by uploading a .shtml file
23RISCO
abrir ↗Exploit-DB
Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass)
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S
100RISCO
abrir ↗Exploit-DB
LANGO Codeigniter Multilingual Script 1.0 - Cross-Site Scripting
LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the site_name par
23RISCO
abrir ↗GitHub PoC★ 17
OpenSSH 7.7 - Username Enumeration
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati
70RISCO
abrir ↗GitHub PoC★ 1
A libssh CVE-2018-10933 scanner written in rust
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul
85RISCO
abrir ↗GitHub PoC
throwawayaccount12312312/precompiled-CVE-2018-10933
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul
85RISCO
abrir ↗GitHub PoC
Multi-threaded, reliable scanner for CVE-2018-10933.
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul
85RISCO
abrir ↗GitHub PoC★ 7
TALOS-2018-0684/cve-2018-4013 poc
An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server l
48RISCO
abrir ↗GitHub PoC★ 172
CVE-2018-3245-PoC
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S
45RISCO
abrir ↗Metasploit0
WebExec Authenticated User Code Execution
Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability
61RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.