Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.305exploits catalogados

36.465CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.466Referência 23.051GitHub PoC 15.051VulnCheck XDB 8.883Nuclei 4.361Metasploit 3.493✓ só verificadosrecentes populares risco

5.629 exploits

Referência✓ VexDay Proof

Joovili 3.0.6 - 'joovili.images.php' Remote File Disclosure

CVE-2007-6620—webappsphp

Directory traversal vulnerability in include/images.inc.php in Joovili 2.x allows remote attackers to read arbitrary fil

23RISCO

abrir ↗

Referência✓ VexDay Proof

mini-pub 0.3 - File Disclosure / Code Execution

CVE-2008-5580—webappsphp

mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to execute arbitrary commands via shell metachara

23RISCO

abrir ↗

Referência✓ VexDay Proof

The Gemini Portal 4.7 - Insecure Cookie Handling

CVE-2008-7024—webappsphp

admin.php in Arz Development The Gemini Portal 4.7 and earlier allows remote attackers to bypass authentication and gain

23RISCO

abrir ↗

Referência✓ VexDay Proof

eFront 3.5.1 / build 2710 - Arbitrary File Upload

CVE-2008-7026—webappsphp

Unrestricted file upload vulnerability in filesystem3.class.php in eFront 3.5.1 build 2710 and earlier allows remote att

23RISCO

abrir ↗

Referência✓ VexDay Proof

RPG.Board 0.0.8Beta2 - Insecure Cookie Handling

CVE-2008-7028—webappsphp

RPG.Board 0.8 Beta2 and earlier allows remote attackers to bypass authentication and gain privileges by setting the keep

23RISCO

abrir ↗

Referência✓ VexDay Proof

phpBB Shadow Premod 2.7.1 - Remote File Inclusion

CVE-2006-4664—webappsphp

PHP remote file inclusion vulnerability in includes/functions_portal.php in Premod Shadow 2.7.1 and earlier allows remot

23RISCO

abrir ↗

Referência✓ VexDay Proof

VicFTPS < 5.0 - 'CWD' Remote Buffer Overflow (PoC)

CVE-2007-1014—doswindows

Stack-based buffer overflow in VicFTPS before 5.0 allows remote attackers to cause a denial of service (application cras

23RISCO

abrir ↗

Referência✓ VexDay Proof

Sony Network Camera SNC-P5 1.0 - ActiveX viewer Heap Overflow (PoC)

CVE-2007-3488—doswindows

Heap-based buffer overflow in the viewer ActiveX control in Sony Network Camera SNC-RZ25N before 1.30; SNC-P1 and SNC-P5

28RISCO

abrir ↗

Referência✓ VexDay Proof

CPCommerce 1.1.0 - Cross-Site Scripting / Local File Inclusion

CVE-2008-1907—webappsphp

Multiple SQL injection vulnerabilities in functions/display_page.func.php in cpCommerce 1.1.0 allow remote attackers to

23RISCO

abrir ↗

Referência✓ VexDay Proof

ThinkEdit 1.9.2 - 'render.php' Remote File Inclusion

CVE-2006-6426—webappsphp

PHP remote file inclusion vulnerability in design/thinkedit/render.php in ThinkEdit 1.9.2 and earlier, when register_glo

23RISCO

abrir ↗

Referência✓ VexDay Proof

Pie Web M{a_e}sher 0.5.3 - Multiple Remote File Inclusions

CVE-2008-5332—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Pie 0.5.3 allow remote attackers to execute arbitrary PHP code via

23RISCO

abrir ↗

Referência✓ VexDay Proof

Colloquy 2.1.3545 - 'INVITE' Format String Denial of Service

CVE-2007-0344—dososx

Multiple format string vulnerabilities in (1) _invitedToRoom: and (2) _invitedToDirectChat: in Colloquy 2.1 and earlier

23RISCO

abrir ↗

Referência✓ VexDay Proof

EZContents CMS 2.0.3 - Multiple Local File Inclusions

CVE-2008-7054—webappsphp

Multiple directory traversal vulnerabilities in ezContents 2.0.3 allow remote attackers to include and execute arbitrary

23RISCO

abrir ↗

Referência✓ VexDay Proof

BandSite CMS 1.1.4 - Download Backup / Cross-Site Scripting / Cross-Site Request Forgery

CVE-2008-7057—webappsphp

Cross-site scripting (XSS) vulnerability in merchandise.php in BandSite CMS 1.1.4 allows remote attackers to inject arbi

23RISCO

abrir ↗

Referência✓ VexDay Proof

LoveCMS 1.6.2 Final (Download Manager 1.0) - Arbitrary File Upload

CVE-2008-7062—webappsphp

Unrestricted file upload vulnerability in admin/index.php in Download Manager module 1.0 for LoveCMS 1.6.2 Final allows

23RISCO

abrir ↗

Referência✓ VexDay Proof

Star Articles 6.0 - Blind SQL Injection (1)

CVE-2008-7075—webappsphp

Multiple SQL injection vulnerabilities in Kalptaru Infotech Ltd. Star Articles 6.0 allow remote attackers to inject arbi

23RISCO

abrir ↗

Referência✓ VexDay Proof

BigAnt Server 2.2 - Remote Overflow (SEH)

CVE-2008-1914—remotewindows

Stack-based buffer overflow in the AntServer module (AntServer.exe) in BigAnt IM Server in BigAnt Messenger 2.2 allows r

60RISCO

abrir ↗

Referência✓ VexDay Proof

MapLab MS4W 2.2.1 - Remote File Inclusion

CVE-2007-1843—webappsphp

PHP remote file inclusion vulnerability in gmapfactory/params.php in MapLab 2.2.1, when register_globals is enabled, all

23RISCO

abrir ↗

Referência✓ VexDay Proof

CodeAvalanche FreeWallpaper - Remote Database Disclosure

CVE-2008-5897—webappsasp

CodeAvalanche FreeWallpaper stores sensitive information under the web root with insufficient access control, which allo

23RISCO

abrir ↗

Referência✓ VexDay Proof

ReVou Twitter Clone - Admin Password Change

CVE-2008-6752—webappsphp

adminlogin/password.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging does not verify the original passw

23RISCO

abrir ↗

Referência✓ VexDay Proof

MySpace Content Zone 3.x - Arbitrary File Upload

CVE-2007-6668—webappsphp

admin/uploadgames.php in MySpace Content Zone (MCZ) 3.x does not require administrative privileges, which allows remote

23RISCO

abrir ↗

Referência✓ VexDay Proof

mxCamArchive 2.2 - Bypass Configuration Download

CVE-2008-6955—webappsphp

mxCamArchive 2.2 stores sensitive information under the web root with insufficient access control, which allows remote a

23RISCO

abrir ↗

Referência✓ VexDay Proof

k-rate - SQL Injection / Cross-Site Scripting

CVE-2008-7098—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in Qsoft K-Rate Premium allow remote attackers to inject arbitrary w

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHP-Fusion 7.0.2 - Blind SQL Injection

CVE-2008-1918—webappsphp

SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the

23RISCO

abrir ↗

Referência✓ VexDay Proof

Envolution 1.1.0 - 'PNSVlang' Remote Code Execution

CVE-2006-6445—webappsphp

Directory traversal vulnerability in error.php in Envolution 1.1.0 and earlier allows remote attackers to include and ex

23RISCO

abrir ↗

Referência✓ VexDay Proof

WebSVN 2.0 - Cross-Site Scripting / File Handling / Code Execution

CVE-2008-5919—webappsphp

Directory traversal vulnerability in rss.php in WebSVN 2.0 and earlier, when magic_quotes_gpc is disabled, allows remote

23RISCO

abrir ↗

Referência✓ VexDay Proof

E-GADS! 2.2.6 - 'common.php?locale' Remote File Inclusion

CVE-2007-2521—webappsphp

PHP remote file inclusion vulnerability in common.php in E-GADS! before 2.2.7 allows remote attackers to execute arbitra

23RISCO

abrir ↗

Referência✓ VexDay Proof

Flexcustomer 0.0.6 - Admin Authentication Bypass / Possible PHP Code Writing

CVE-2008-6761—webappsphp

Static code injection vulnerability in admin/install.php in Flexcustomer 0.0.6 might allow remote attackers to inject ar

23RISCO

abrir ↗

Referência✓ VexDay Proof

samPHPweb 4.2.2 - 'db.php' Remote File Inclusion

CVE-2008-0143—webappsphp

PHP remote file inclusion vulnerability in common/db.php in samPHPweb, possibly 4.2.2 and others, as provided with SAM B

23RISCO

abrir ↗

Referência✓ VexDay Proof

WeBid 0.5.4 - 'item.php' SQL Injection

CVE-2008-7119—webappsphp

SQL injection vulnerability in item.php in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL c

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.