Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.305exploits catalogados

36.465CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.466Referência 23.051GitHub PoC 15.051VulnCheck XDB 8.883Nuclei 4.361Metasploit 3.493✓ só verificadosrecentes populares risco

5.629 exploits

Referência✓ VexDay Proof

bubbling library 1.32 - 'uri' Remote File Disclosure

CVE-2008-0521—webappsphp

Multiple directory traversal vulnerabilities in Bubbling Library 1.32 allow remote attackers to read arbitrary files via

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHPmyGallery Gold 1.51 - 'index.php' Directory Traversal

CVE-2008-5598—webappsphp

Directory traversal vulnerability in index.php in PHPmyGallery 1.51 gold allows remote attackers to list arbitrary direc

23RISCO

abrir ↗

Referência✓ VexDay Proof

Pre Classified Listings - Insecure Cookie Handling

CVE-2008-6231—webappsphp

Pre Classified Listing PHP allows remote attackers to bypass authentication and gain administrative access by setting th

23RISCO

abrir ↗

Referência✓ VexDay Proof

FREEsimplePHPGuestbook - 'Guestbook.php' Remote Code Execution

CVE-2008-6934—webappsphp

Static code injection vulnerability in Sanus|artificium (aka Sanusart) Free simple guestbook PHP script, when downloaded

23RISCO

abrir ↗

Referência✓ VexDay Proof

Pollbooth 2.0 - 'pollID' SQL Injection

CVE-2008-4765—webappsphp

SQL injection vulnerability in pollBooth.php in osCommerce Poll Booth Add-On 2.0 allows remote attackers to execute arbi

23RISCO

abrir ↗

Referência✓ VexDay Proof

CyberBrau 0.9.4 - '/forum/track.php' Remote File Inclusion

CVE-2006-5400—webappsphp

PHP remote file inclusion vulnerability in forum/track.php in CyberBrau 0.9.4, when register_globals is enabled, allows

23RISCO

abrir ↗

Referência✓ VexDay Proof

MyCMS 0.9.8 - Remote Command Execution (1)

CVE-2007-3587—webappsphp

MyCMS 0.9.8 and earlier allows remote attackers to gain privileges via the admin cookie parameter, as demonstrated by a

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHP-Stats 0.1.9.2 - Multiple Vulnerabilities

CVE-2007-5452—webappsphp

Multiple SQL injection vulnerabilities in php-stats.recjs.php in Php-Stats 0.1.9.2 allow remote attackers to execute arb

23RISCO

abrir ↗

Referência✓ VexDay Proof

xeCMS 1.x - 'view.php' Remote File Disclosure

CVE-2007-6508—webappsphp

Directory traversal vulnerability in view.php in xeCMS 1.0 allows remote attackers to read arbitrary files via a ..%2F (

23RISCO

abrir ↗

Referência✓ VexDay Proof

TlAds 1.0 - Remote Insecure Cookie Handling

CVE-2008-4783—webappsphp

tlAds 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the tlAds_login coo

23RISCO

abrir ↗

Referência✓ VexDay Proof

QuoteBook - Remote Configuration File Disclosure

CVE-2009-0828—webappsphp

QuoteBook stores quotes.inc under the web root with insufficient access control, which allows remote attackers to obtain

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHP-Nuke Module htmltonuke 2.0alpha - 'htmltonuke.php' Remote File Inclusion

CVE-2006-0308—webappsphp

PHP remote file inclusion vulnerability in htmltonuke.php in the htmltonuke 2.0 alpha, and possibly other versions, modu

23RISCO

abrir ↗

Referência✓ VexDay Proof

PortailPHP mod_phpalbum 2.1.5 - 'chemin' Remote File Inclusion

CVE-2006-4498—webappsphp

PHP remote file inclusion vulnerability in sommaire_admin.php in PhpAlbum (mod_phpalbum) 2.15 for PortailPHP allows remo

23RISCO

abrir ↗

Referência✓ VexDay Proof

Bloginator 1a - Cookie Bypass / SQL Injection

CVE-2009-1050—webappsphp

Bloginator 1A allows remote attackers to bypass authentication and gain administrative access by setting the identifyYou

23RISCO

abrir ↗

Referência✓ VexDay Proof

sBLOG 0.7.3 Beta - '/inc/lang.php' Local File Inclusion

CVE-2007-1801—webappsphp

Directory traversal vulnerability in inc/lang.php in sBLOG 0.7.3 Beta allows remote attackers to include and execute arb

23RISCO

abrir ↗

Referência✓ VexDay Proof

XOOPS Module Jobs 2.4 - 'cid' SQL Injection

CVE-2007-2370—webappsphp

SQL injection vulnerability in index.php in the John Mordo Jobs 2.4 and earlier module for XOOPS allows remote attackers

23RISCO

abrir ↗

Referência✓ VexDay Proof

Chilkat Zip ActiveX Component 12.4 - Multiple Insecure Methods

CVE-2007-3633—remotewindows

Absolute path traversal vulnerability in the Chilkat Software Chilkat Zip ActiveX control in ChilkatZip2.dll 12.4.2.0 al

23RISCO

abrir ↗

Referência✓ VexDay Proof

DevMass Shopping Cart 1.0 - Remote File Inclusion

CVE-2007-6133—webappsphp

PHP remote file inclusion vulnerability in admin/kfm/initialise.php in DevMass Shopping Cart 1.0 and earlier allows remo

23RISCO

abrir ↗

Referência✓ VexDay Proof

Microsoft Internet Explorer - XML Parsing Remote Buffer Overflow

CVE-2008-4844—remotewindows

Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet

50RISCO

abrir ↗

Referência✓ VexDay Proof

LeadTools Raster Thumbnail Object Library - 'LTRTM14e.dll' Remote Buffer Overflow

CVE-2007-2787—remotewindows

Stack-based buffer overflow in the BrowseDir function in the (1) lttmb14E.ocx or (2) LTRTM14e.DLL ActiveX control in Lea

23RISCO

abrir ↗

Referência✓ VexDay Proof

Pligg CMS 9.9.0 - Cross-Site Scripting / Local File Inclusion / SQL Injection

CVE-2008-7089—webappsphp

Cross-site scripting (XSS) vulnerability in Pligg 9.9 and earlier allows remote attackers to inject arbitrary web script

23RISCO

abrir ↗

Referência✓ VexDay Proof

SiteDepth CMS 3.44 - 'ShowImage.php?name' File Disclosure

CVE-2007-3404—webappsphp

Directory traversal vulnerability in ShowImage.php in SiteDepth CMS 3.44 allows remote attackers to read arbitrary files

23RISCO

abrir ↗

Referência✓ VexDay Proof

WordPress Plugin WassUp 1.4.3 - 'to_date' SQL Injection

CVE-2008-0520—webappsphp

Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote att

23RISCO

abrir ↗

Referência✓ VexDay Proof

Easy Scripts Answer and Question Script - Multiple Vulnerabilities

CVE-2009-1663—webappsphp

Unrestricted file upload vulnerability in myaccount.php in Easy Scripts Answer and Question Script allows remote attacke

23RISCO

abrir ↗

Referência✓ VexDay Proof

Philips VOIP841 Firmware 1.0.4.800 - Multiple Vulnerabilities

CVE-2008-4876—remotehardware

Cross-site scripting (XSS) vulnerability in the web server component in Philips Electronics VOIP841 DECT Phone with firm

23RISCO

abrir ↗

Referência✓ VexDay Proof

WebCards 1.3 - SQL Injection

CVE-2008-4877—webappsphp

SQL injection vulnerability in admin.php in WebCards 1.3, when magic_quotes_gpc is disabled, allows remote attackers to

23RISCO

abrir ↗

Referência✓ VexDay Proof

Maran PHP Shop - 'prod.php' SQL Injection

CVE-2008-4879—webappsphp

SQL injection vulnerability in prod.php in Maran PHP Shop allows remote attackers to execute arbitrary SQL commands via

23RISCO

abrir ↗

Referência✓ VexDay Proof

Xilisoft Video Converter Wizard 3 - '.cue' Stack Buffer Overflow (PoC)

CVE-2009-1370—doswindows

Stack-based buffer overflow in ape_plugin.plg in Xilisoft Video Converter 3.1.53.0704n and 5.1.23.0402 allows remote att

23RISCO

abrir ↗

Referência✓ VexDay Proof

OpenSSL < 0.9.8i - DTLS ChangeCipherSpec Remote Denial of Service

CVE-2009-1386—dosmultiple

ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and

60RISCO

abrir ↗

Referência✓ VexDay Proof

CRE Loaded 6.2 - 'products_id' SQL Injection

CVE-2009-1403—webappsphp

SQL injection vulnerability in product_info.php in CRE Loaded 6.2 allows remote attackers to execute arbitrary SQL comma

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.