Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
75.526exploits catalogados
34.478CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.443Referência 21.534GitHub PoC 13.654VulnCheck XDB 8.213Nuclei 4.218Metasploit 3.464✓ só verificadosrecentespopularesrisco
21.497 exploits
Referência
CVE-2009-2399
PHP remote file inclusion vulnerability in dm-albums/template/album.php in DM FileManager 3.9.4, when register_globals i
23RISCO
abrir ↗Referência
CVE-2009-2769
PHP remote file inclusion vulnerability in include/timesheet.php in Ultrize TimeSheet 1.2.2, when register_globals is en
23RISCO
abrir ↗Referência
CVE-2012-2275
Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijac
23RISCO
abrir ↗Referência
CVE-2012-2275
Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijac
23RISCO
abrir ↗Referência
CVE-2007-1152
Multiple directory traversal vulnerabilities in Pyrophobia 2.1.3.1 allow remote attackers to read arbitrary files via a
23RISCO
abrir ↗Referência
CVE-2009-3124
Directory traversal vulnerability in get_message.cgi in QuarkMail allows remote attackers to read arbitrary files via a
23RISCO
abrir ↗Referência✓ VexDay Proof
e107 0.617 - Cross-Site Scripting Remote Cookie Disclosure
Cross-site scripting (XSS) vulnerability in e107 0.617 and earlier allows remote attackers to inject arbitrary web scrip
23RISCO
abrir ↗Referência✓ VexDay Proof
Admbook 1.2.2 - 'x-forwarded-for' Remote Command Execution
Direct static code injection vulnerability in write.php in Admbook 1.2.2 and earlier allows remote attackers to execute
23RISCO
abrir ↗Referência✓ VexDay Proof
TR Newsportal 0.36tr1 - 'poll.php' Remote File Inclusion
PHP remote file inclusion vulnerability in extras/poll/poll.php in Florian Amrhein NewsPortal before 0.37, and TR Newspo
28RISCO
abrir ↗Referência✓ VexDay Proof
Web Oddity Web Server 0.09b - Directory Traversal
Directory traversal vulnerability in Web Oddity 0.09b allows remote attackers to read arbitrary files via a .. (dot dot)
23RISCO
abrir ↗Referência✓ VexDay Proof
SiteBuilderElite 1.2 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in SiteBuilder Elite 1.2 allow remote attackers to execute arbitrary
23RISCO
abrir ↗Referência✓ VexDay Proof
merlix educate servert - Authentication Bypass / File Disclosure
Merlix Educate Server allows remote attackers to bypass intended security restrictions and obtain sensitive information
23RISCO
abrir ↗Referência✓ VexDay Proof
adaptweb 0.9.2 - Local File Inclusion / SQL Injection
Directory traversal vulnerability in index.php in AdaptWeb 0.9.2 allows remote attackers to read arbitrary files via a .
23RISCO
abrir ↗Referência
aiohttp 3.9.1 - directory traversal PoC
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
70RISCO
abrir ↗Referência
CVE-2014-2022
SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier a
23RISCO
abrir ↗Referência
CVE-2010-4313
Unrestricted file upload vulnerability in fileman_file_upload.php in Orbis CMS 1.0.2 allows remote authenticated users t
23RISCO
abrir ↗Referência
CVE-2025-34054
AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command Injection
48RISCO
abrir ↗Referência
CVE-2025-34054
AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command Injection
48RISCO
abrir ↗Referência
CVE-2014-3138
SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1
23RISCO
abrir ↗Referência
CVE-2014-3138
SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1
23RISCO
abrir ↗Referência
CVE-2015-7252
Cross-site scripting (XSS) vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_
23RISCO
abrir ↗Referência
CVE-2012-6038
admin/core/admin_func.php in razorCMS before 1.2.1 does not properly restrict access to certain administrator directorie
23RISCO
abrir ↗Referência✓ VexDay Proof
Monalbum 0.8.7 - Remote Code Execution
Static code injection vulnerability in admin/admin_configuration.php in Monalbum 0.8.7 allows remote authenticated users
23RISCO
abrir ↗Referência✓ VexDay Proof
Poppawid 2.7 - 'form' Remote File Inclusion
PHP remote file inclusion vulnerability in mail/childwindow.inc.php in Poppawid 2.7 allows remote attackers to execute a
23RISCO
abrir ↗Referência✓ VexDay Proof
RunCMS 1.6 - Multiple Vulnerabilities
RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a m
23RISCO
abrir ↗Referência✓ VexDay Proof
AlkalinePHP 0.77.35 - 'adduser.php' Arbitrary Add Admin
AlkalinePHP 0.77.35 and earlier allows remote attackers to bypass authentication and gain administrative access by creat
23RISCO
abrir ↗Referência✓ VexDay Proof
Tlnews 2.2 - Insecure Cookie Handling
TlNews 2.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlNews_login c
23RISCO
abrir ↗Referência
CVE-2014-9099
Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attacker
23RISCO
abrir ↗Referência
CVE-2017-14843
Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.
23RISCO
abrir ↗Referência
CVE-2017-14842
Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.
23RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.