Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.107exploits catalogados

36.322CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.464Referência 22.936GitHub PoC 15.010VulnCheck XDB 8.846Nuclei 4.361Metasploit 3.490✓ só verificadosrecentes populares risco

5.629 exploits

Referência✓ VexDay Proof

phpsyncml 0.1.2 - Remote File Inclusion

CVE-2007-4978—webappsphp

Multiple PHP remote file inclusion vulnerabilities in phpSyncML 0.1.2 and earlier allow remote attackers to execute arbi

23RISCO

abrir ↗

Referência✓ VexDay Proof

PowerBook 1.21 - 'index.php' Local File Inclusion

CVE-2008-1537—webappsphp

Directory traversal vulnerability in pb_inc/admincenter/index.php in PowerScripts PowerBook 1.21 allows remote attackers

23RISCO

abrir ↗

Referência✓ VexDay Proof

WebCreator 0.2.6-rc3 - 'moddir' Remote File Inclusion

CVE-2007-1459—webappsphp

Multiple PHP remote file inclusion vulnerabilities in WebCreator 0.2.6-rc3 and earlier allow remote attackers to execute

23RISCO

abrir ↗

Referência✓ VexDay Proof

hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities

CVE-2007-6502—webappsasp

Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to obtain sensitive information via (1)

23RISCO

abrir ↗

Referência✓ VexDay Proof

Multi-Page Comment System 1.1.0 - Insecure Cookie Handling

CVE-2008-2293—webappsphp

admin.php in Multi-Page Comment System (MPCS) 1.0 and 1.1 allows remote attackers to bypass authentication and gain priv

23RISCO

abrir ↗

Referência✓ VexDay Proof

Galatolo Web Manager 1.0 - SQL Injection

CVE-2008-2700—webappsphp

SQL injection vulnerability in view.php in Galatolo WebManager 1.0 and earlier allows remote attackers to execute arbitr

23RISCO

abrir ↗

Referência✓ VexDay Proof

AyeView 2.20 - Invalid Bitmap Header Parsing Crash

CVE-2008-5937—doswindows

AyeView 2.20 allows user-assisted attackers to cause a denial of service (memory consumption or application crash) via a

23RISCO

abrir ↗

Referência✓ VexDay Proof

Gravy Media Photo Host 1.0.8 - Local File Disclosure

CVE-2009-2184—webappsphp

Absolute path traversal vulnerability in forcedownload.php in Gravy Media Photo Host 1.0.8 allows remote attackers to re

23RISCO

abrir ↗

Referência✓ VexDay Proof

WordPress Plugin Download - 'dl_id' SQL Injection

CVE-2008-1646—webappsphp

SQL injection vulnerability in wp-download.php in the WP-Download 1.2 plugin for WordPress allows remote attackers to ex

23RISCO

abrir ↗

Referência✓ VexDay Proof

Simple HTTPd 1.38 - Multiple Vulnerabilities

CVE-2007-6404—remotewindows

Directory traversal vulnerability in Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attac

23RISCO

abrir ↗

Referência✓ VexDay Proof

WordPress Plugin WP-Cal 0.3 - 'editevent.php' SQL Injection

CVE-2008-0490—webappsphp

SQL injection vulnerability in functions/editevent.php in the WP-Cal 0.3 plugin for WordPress allows remote attackers to

23RISCO

abrir ↗

Referência✓ VexDay Proof

HomePH Design 2.10 RC2 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting

CVE-2008-2981—webappsphp

PHP remote file inclusion vulnerability in admin/templates/template_thumbnail.php in HomePH Design 2.10 RC2, when regist

23RISCO

abrir ↗

Referência✓ VexDay Proof

Acc Autos 4.0 - Insecure Cookie Handling

CVE-2008-6292—webappsphp

Acc Autos 4.0 allows remote attackers to bypass authentication and gain administrative access by setting the (1) usernam

23RISCO

abrir ↗

Referência✓ VexDay Proof

AvailScript Jobs Portal Script - (Authenticated) Arbitrary File Upload

CVE-2008-7021—webappsphp

Unrestricted file upload vulnerability in editlogo.php in AvailScript Jobs Portal Script allows remote authenticated use

23RISCO

abrir ↗

Referência✓ VexDay Proof

Popcorn 1.87 - Remote Heap Overflow (PoC)

CVE-2009-1647—doswindows

Heap-based buffer overflow in popcorn.exe in Ultrafunk Popcorn 1.87 allows remote POP3 servers to cause a denial of serv

23RISCO

abrir ↗

Referência✓ VexDay Proof

Web Oddity Web Server 0.09b - Directory Traversal

CVE-2007-4726—remotelinux

Directory traversal vulnerability in Web Oddity 0.09b allows remote attackers to read arbitrary files via a .. (dot dot)

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component GameQ 4.0 - SQL Injection

CVE-2008-2701—webappsphp

SQL injection vulnerability in the GameQ (com_gameq) component 4.0 and earlier for Joomla! allows remote attackers to ex

23RISCO

abrir ↗

Referência✓ VexDay Proof

e107 0.617 - Cross-Site Scripting Remote Cookie Disclosure

CVE-2005-2327—webappsphp

Cross-site scripting (XSS) vulnerability in e107 0.617 and earlier allows remote attackers to inject arbitrary web scrip

23RISCO

abrir ↗

Referência✓ VexDay Proof

SiteBuilderElite 1.2 - Multiple Remote File Inclusions

CVE-2008-1123—webappsphp

Multiple PHP remote file inclusion vulnerabilities in SiteBuilder Elite 1.2 allow remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência✓ VexDay Proof

JShop 1.x < 2.x - 'xPage' Local File Inclusion

CVE-2008-1624—webappsphp

Directory traversal vulnerability in v2demo/page.php in Jshop Server 1.x through 2.x allows remote attackers to include

23RISCO

abrir ↗

Referência✓ VexDay Proof

UBBCentral UBB.Threads 6.4.x < 6.5.2 - 'thispath' Remote File Inclusion

CVE-2006-2568—webappsphp

PHP remote file inclusion vulnerability in addpost_newpoll.php in UBB.threads 6.4 through 6.5.2 and 6.5.1.1 (trial) allo

23RISCO

abrir ↗

Referência✓ VexDay Proof

VidShare Pro - Arbitrary File Upload

CVE-2009-1750—webappsphp

Unrestricted file upload vulnerability in VidSharePro allows remote authenticated users to execute arbitrary code by upl

23RISCO

abrir ↗

Referência✓ VexDay Proof

Sisfo Kampus 2006 - 'dwoprn.php?f' Arbitrary File Download

CVE-2007-4895—webappsphp

Directory traversal vulnerability in dwoprn.php in Sisfo Kampus 2006 (Semarang 3) allows remote attackers to read arbitr

23RISCO

abrir ↗

Referência✓ VexDay Proof

AlkalinePHP 0.77.35 - 'adduser.php' Arbitrary Add Admin

CVE-2008-2346—webappsphp

AlkalinePHP 0.77.35 and earlier allows remote attackers to bypass authentication and gain administrative access by creat

23RISCO

abrir ↗

Referência✓ VexDay Proof

Tlnews 2.2 - Insecure Cookie Handling

CVE-2008-4752—webappsphp

TlNews 2.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlNews_login c

23RISCO

abrir ↗

Referência✓ VexDay Proof

Poppawid 2.7 - 'form' Remote File Inclusion

CVE-2007-5221—webappsphp

PHP remote file inclusion vulnerability in mail/childwindow.inc.php in Poppawid 2.7 allows remote attackers to execute a

23RISCO

abrir ↗

Referência✓ VexDay Proof

RunCMS 1.6 - Multiple Vulnerabilities

CVE-2007-6546—webappsphp

RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a m

23RISCO

abrir ↗

Referência✓ VexDay Proof

adaptweb 0.9.2 - Local File Inclusion / SQL Injection

CVE-2009-2151—webappsphp

Directory traversal vulnerability in index.php in AdaptWeb 0.9.2 allows remote attackers to read arbitrary files via a .

23RISCO

abrir ↗

Referência✓ VexDay Proof

Noticeware E-mail Server 5.1.2.2 - 'POP3' Denial of Service

CVE-2008-6185—doswindows

NoticeWare Email Server NG 5.1.2.2 allows remote attackers to cause a denial of service (crash) via multiple POP3 reques

23RISCO

abrir ↗

Referência✓ VexDay Proof

BolinOS 4.6.1 - Local File Inclusion / Cross-Site Scripting

CVE-2008-1557—webappsphp

BolinOS 4.6.1 allows remote attackers to obtain sensitive information via a direct request to system/actionspages/_b/con

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.