Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.305exploits catalogados

36.465CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.466Referência 23.051GitHub PoC 15.051VulnCheck XDB 8.883Nuclei 4.361Metasploit 3.493✓ só verificadosrecentes populares risco

5.629 exploits

Referência✓ VexDay Proof

DodosMail 2.0.1 - 'dodosmail.php' Remote File Inclusion

CVE-2006-5841—webappsphp

Multiple PHP remote file inclusion vulnerabilities in dodosmail.php in DodosMail 2.0.1 and earlier, and possibly 2.1, al

23RISCO

abrir ↗

Referência✓ VexDay Proof

Web Wiz Rich Text Editor 4.0 - Multiple Vulnerabilities

CVE-2008-0473—webappsasp

RTE_popup_save_file.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to upload (1) .html and (2) .htm files v

23RISCO

abrir ↗

Referência✓ VexDay Proof

Noticeware Email Server 4.6.1.0 - Denial of Service

CVE-2008-1713—doswindows

MailServer.exe in NoticeWare Email Server 4.6.1.0 allows remote attackers to cause a denial of service (application cras

23RISCO

abrir ↗

Referência✓ VexDay Proof

Scientific Image DataBase 0.41 - Blind SQL Injection

CVE-2008-2834—webappsphp

SQL injection vulnerability in projects.php in Scientific Image DataBase 0.41 allows remote attackers to execute arbitra

23RISCO

abrir ↗

Referência✓ VexDay Proof

Online Grades 3.2.4 - Authentication Bypass

CVE-2009-0453—webappsphp

Online Grades 3.2.4 allows remote attackers to obtain configuration information via a direct request to phpinfo.php, whi

23RISCO

abrir ↗

Referência✓ VexDay Proof

DMXReady Registration Manager 1.1 - Database Disclosure

CVE-2009-1821—webappsasp

DMXReady Registration Manager 1.1 stores sensitive information under the web root with insufficient access control, whic

23RISCO

abrir ↗

Referência✓ VexDay Proof

Hot Open Tickets 11012004 - 'CLASS_PATH' Remote File Inclusion

CVE-2006-2730—webappsphp

PHP remote file inclusion vulnerability in admin/lib_action_step.php in Hot Open Tickets (HOT) 11012004_ver2f, when regi

23RISCO

abrir ↗

Referência✓ VexDay Proof

Maxtrade AIO 1.3.23 - 'categori' SQL Injection

CVE-2008-2847—webappsphp

SQL injection vulnerability in the Trade module in Maxtrade AIO 1.3.23 allows remote attackers to execute arbitrary SQL

23RISCO

abrir ↗

Referência✓ VexDay Proof

Drupal 4.7 - 'Attachment mod_mime' Remote Command Execution

CVE-2006-2743—webappsphp

Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple

28RISCO

abrir ↗

Referência✓ VexDay Proof

Azucar CMS 1.3 - '/admin/index_sitios.php' File Inclusion

CVE-2006-6720—webappsphp

PHP remote file inclusion vulnerability in admin/index_sitios.php in Azucar CMS 1.3 allows remote attackers to execute a

23RISCO

abrir ↗

Referência✓ VexDay Proof

LightBlog 8.4.1.1 - Remote Code Execution

CVE-2007-5374—webappsphp

cp_memberedit.php in LightBlog 8.4.1.1 does not check for administrative credentials when processing an admin action, wh

23RISCO

abrir ↗

Referência✓ VexDay Proof

Easy Photo Gallery 2.1 - Arbitrary Add Admin / remove user

CVE-2008-4167—webappsphp

useradmin.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 does not require administrative authentication, which allow

23RISCO

abrir ↗

Referência✓ VexDay Proof

Pindorama 0.1 - 'client.php' Remote File Inclusion

CVE-2007-5387—webappsphp

PHP remote file inclusion vulnerability in active/components/xmlrpc/client.php in Pindorama 0.1 allows remote attackers

28RISCO

abrir ↗

Referência✓ VexDay Proof

LoveCMS 1.6.2 Final - Arbitrary File Delete

CVE-2008-5794—webappsphp

Directory traversal vulnerability in system/admin/images.php in LoveCMS 1.6.2 Final allows remote attackers to delete ar

23RISCO

abrir ↗

Referência✓ VexDay Proof

cpDynaLinks 1.02 - 'category.php' SQL Injection

CVE-2007-5408—webappsphp

SQL injection vulnerability in category.php in cpDynaLinks 1.02 allows remote attackers to execute arbitrary SQL command

23RISCO

abrir ↗

Referência✓ VexDay Proof

fhttpd 0.4.2 - 'un64()' Remote Denial of Service

CVE-2008-7014—doslinux

fhttpd 0.4.2 allows remote attackers to cause a denial of service (crash) via an Authorization HTTP header with an inval

23RISCO

abrir ↗

Referência✓ VexDay Proof

FS4104-AW VDSL Device (Rooter) - GoAhead WebServer Disclosure

CVE-2007-6702—remotehardware

goform/QuickStart_c0 on the GoAhead Web Server on the FS4104-AW (aka rooter) VDSL device contains a password in the type

23RISCO

abrir ↗

Referência✓ VexDay Proof

TemaTres 1.0.3 - Authentication Bypass / SQL Injection / Cross-Site Scripting

CVE-2009-1584—webappsphp

Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magic_quotes_gpc is disabled, allow remote atta

23RISCO

abrir ↗

Referência✓ VexDay Proof

OwnRS blog beta3 - SQL Injection / Cross-Site Scripting

CVE-2008-2856—webappsphp

SQL injection vulnerability in clanek.php in OwnRS Beta 3 allows remote attackers to execute arbitrary SQL commands via

23RISCO

abrir ↗

Referência✓ VexDay Proof

Techno Dreams Articles & Papers 2.0 - SQL Injection

CVE-2006-4891—webappsasp

SQL injection vulnerability in ArticlesTableview.asp in Techno Dreams Articles & Papers Package 2.0 and earlier allows r

23RISCO

abrir ↗

Referência✓ VexDay Proof

Flatnuke 3 - Remote Command Execution / Privilege Escalation

CVE-2007-5774—webappsphp

index.php in the File Manager module in Flatnuke 3 allows remote attackers to obtain sensitive information via an invali

23RISCO

abrir ↗

Referência✓ VexDay Proof

nuseo PHP enterprise 1.6 - Remote File Inclusion

CVE-2007-5409—webappsphp

PHP remote file inclusion vulnerability in admin/nuseo_admin_d.php in NuSEO PHP Enterprise 1.6 (NuSEO.PHP), when registe

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHP Live Helper 2.0.1 - Multiple Vulnerabilities

CVE-2008-3763—webappsphp

Variable overwrite vulnerability in libsecure.php in Turnkey PHP Live Helper 2.0.1 and earlier, when register_globals is

23RISCO

abrir ↗

Referência✓ VexDay Proof

TlGuestBook 1.2 - Insecure Cookie Handling

CVE-2008-5065—webappsphp

TlGuestBook 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlGuestBo

23RISCO

abrir ↗

Referência✓ VexDay Proof

mini-pub 0.3 - Local Directory Traversal / File Disclosure

CVE-2008-5883—webappsphp

Absolute path traversal vulnerability in front-end/dir.php in mini-pub 0.3 and earlier allows remote attackers to list a

23RISCO

abrir ↗

Referência✓ VexDay Proof

PhpCommander 3.0 - 'upload' Remote Code Execution

CVE-2006-4636—webappsphp

Directory traversal vulnerability in SZEWO PhpCommander 3.0 and earlier allows remote attackers to include and execute a

23RISCO

abrir ↗

Referência✓ VexDay Proof

shibby shop 2.2 - Multiple Vulnerabilities

CVE-2008-2872—webappsphp

SQL injection vulnerability in default.asp in sHibby sHop 2.2 and earlier allows remote attackers to execute arbitrary S

23RISCO

abrir ↗

Referência✓ VexDay Proof

WebBuilder 2.0 - 'StageLoader.php' Remote File Inclusion

CVE-2007-0703—webappsphp

PHP remote file inclusion vulnerability in library/StageLoader.php in WebBuilder 2.0 and earlier allows remote attackers

23RISCO

abrir ↗

Referência✓ VexDay Proof

Ninja Blog 4.8 - Remote Information Disclosure

CVE-2009-0325—webappsphp

Directory traversal vulnerability in entries/index.php in Ninja Blog 4.8, when magic_quotes_gpc is disabled, allows remo

23RISCO

abrir ↗

Referência✓ VexDay Proof

Webavis 0.1.1 - 'class.php?root' Remote File Inclusion

CVE-2007-2943—webappsphp

PHP remote file inclusion vulnerability in class/class.php in Webavis 0.1.1 allows remote attackers to execute arbitrary

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.