Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

72.018exploits catalogados

32.219CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 20.023GitHub PoC 13.334VulnCheck XDB 8.195Nuclei 4.217Metasploit 3.463✓ só verificadosrecentes populares risco

20.023 exploits

Referência

CVE-2014-9439

CVE-2014-9439—

Cross-site scripting (XSS) vulnerability in Easy File Sharing Web Server 6.8 allows remote attackers to inject arbitrary

23RISCO

abrir ↗

Referência

CVE-2009-4686

CVE-2009-4686—

Cross-site scripting (XSS) vulnerability in account.php in phplemon AdQuick 2.2.1 allows remote attackers to inject arbi

23RISCO

abrir ↗

Referência

CVE-2009-4685

CVE-2009-4685—

Cross-site scripting (XSS) vulnerability in celebrities.php in PHP Scripts Now Astrology allows remote attackers to inje

23RISCO

abrir ↗

Referência

CVE-2009-4684

CVE-2009-4684—

Cross-site scripting (XSS) vulnerability in index.php in EZodiak allows remote attackers to inject arbitrary web script

23RISCO

abrir ↗

Referência

CVE-2009-4464

CVE-2009-4464—

Cross-site scripting (XSS) vulnerability in searchadvance.asp in Active Business Directory 2 allows remote attackers to

23RISCO

abrir ↗

Referência

CVE-2009-4714

CVE-2009-4714—

Cross-site scripting (XSS) vulnerability in the quiz module for XOOPS Celepar allows remote attackers to inject arbitrar

23RISCO

abrir ↗

Referência

CVE-2009-4856

CVE-2009-4856—

Cross-site scripting (XSS) vulnerability in subitems.php in PHP Easy Shopping Cart 3.1R allows remote attackers to injec

23RISCO

abrir ↗

Referência

CVE-2009-4782

CVE-2009-4782—

Multiple cross-site scripting (XSS) vulnerabilities in Theeta CMS, possibly 0.01, allow remote attackers to inject arbit

23RISCO

abrir ↗

Referência

CVE-2008-6924

CVE-2008-6924—

Multiple cross-site scripting (XSS) vulnerabilities in register.php in eSyndiCat Directory 2.2 allow remote attackers to

23RISCO

abrir ↗

Referência

CVE-2009-4575

CVE-2009-4575—

Cross-site scripting (XSS) vulnerability in the Q-Personel (com_qpersonel) component 1.0.2 RC2 for Joomla! allows remote

23RISCO

abrir ↗

Referência

CVE-2009-4692

CVE-2009-4692—

Cross-site scripting (XSS) vulnerability in index.php in RadScripts RadLance Gold 7.5 allows remote attackers to inject

23RISCO

abrir ↗

Referência

CVE-2009-4697

CVE-2009-4697—

Multiple cross-site scripting (XSS) vulnerabilities in index.php in RadNICS Gold 5 allow remote attackers to inject arbi

23RISCO

abrir ↗

Referência

CVE-2009-4713

CVE-2009-4713—

Multiple cross-site scripting (XSS) vulnerabilities in the Qas (aka Quas) module for XOOPS Celepar allow remote attacker

23RISCO

abrir ↗

Referência

CVE-2009-3719

CVE-2009-3719—

Cross-site scripting (XSS) vulnerability in comment.asp in Battle Blog 1.25 and 1.30 build 2 allows remote attackers to

23RISCO

abrir ↗

Referência

CVE-2014-2090

CVE-2014-2090—

Multiple cross-site scripting (XSS) vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inje

23RISCO

abrir ↗

Referência

Pro Chat Rooms 3.0.2 - Cross-Site Scripting / Cross-Site Request Forgery

CVE-2008-6502—

Directory traversal vulnerability in Pro Chat Rooms 3.0.2 allows remote authenticated users to select an arbitrary local

23RISCO

abrir ↗

Referência

CVE-2016-7385

CVE-2016-7385—

For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3

23RISCO

abrir ↗

Referência

CVE-2016-7083

CVE-2016-7083—

VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, when Cortado Thin

23RISCO

abrir ↗

Referência

CVE-2017-16843

CVE-2017-16843—

Vonage VDV-23 115 3.2.11-0.9.40 devices have stored XSS via the NewKeyword or NewDomain field to /goform/RgParentalBasic

23RISCO

abrir ↗

Referência

CVE-2014-125116

CVE-2014-125116CRITICAL

HybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration Injection

63RISCO

abrir ↗

Referência

CVE-2014-125116

CVE-2014-125116CRITICAL

HybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration Injection

63RISCO

abrir ↗

Referência

CVE-2014-125116

CVE-2014-125116CRITICAL

HybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration Injection

63RISCO

abrir ↗

Referência

CVE-2020-8493

CVE-2020-8493MEDIUM

A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via

33RISCO

abrir ↗

Referência

CVE-2008-6325

CVE-2008-6325—

Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Classifieds Script allow remote attackers to inject arbit

23RISCO

abrir ↗

Referência

CVE-2018-5705

CVE-2018-5705—

Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The affected function is its search engine (the t parameter to t

23RISCO

abrir ↗

Referência

CVE-2018-5705

CVE-2018-5705—

Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The affected function is its search engine (the t parameter to t

23RISCO

abrir ↗

Referência

CVE-2009-4908

CVE-2009-4908—

Multiple cross-site scripting (XSS) vulnerabilities in oBlog allow remote attackers to inject arbitrary web script or HT

23RISCO

abrir ↗

Referência

CVE-2009-3562

CVE-2009-3562—

Cross-site scripting (XSS) vulnerability in Xerver HTTP Server 4.32 allows remote attackers to inject arbitrary web scri

23RISCO

abrir ↗

Referência

PHP-Fusion 6.01.14 - Blind SQL Injection

CVE-2008-1918—

SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the

23RISCO

abrir ↗

Referência

PHP-Fusion 7.0.2 - Blind SQL Injection

CVE-2008-1918—

SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.