Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

75.526exploits catalogados

34.478CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.443Referência 21.534GitHub PoC 13.654VulnCheck XDB 8.213Nuclei 4.218Metasploit 3.464✓ só verificadosrecentes populares risco

21.534 exploits

Referência✓ VexDay Proof

Simplog 0.9.2 - 's' Remote Command Execution

CVE-2006-1779—webappsphp

Cross-site scripting (XSS) vulnerability in login.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attacke

23RISCO

abrir ↗

Referência

CVE-2018-14418

CVE-2018-14418—

In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI.

23RISCO

abrir ↗

Referência

CVE-2015-3325

CVE-2015-3325—

SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPress allows remote attackers to

23RISCO

abrir ↗

Referência

CVE-2017-16953

CVE-2017-16953—

connoppp.cgi on ZTE ZXDSL 831CII devices does not require HTTP Basic Authentication, which allows remote attackers to mo

28RISCO

abrir ↗

Referência

CVE-2009-3254

CVE-2009-3254—

Multiple stack-based buffer overflows in Ultimate Player 1.56 beta allow remote attackers to execute arbitrary code via

23RISCO

abrir ↗

Referência

CVE-2019-7439

CVE-2019-7439—

cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices allows a DoS (Hang) via the mask POST parameter.

23RISCO

abrir ↗

Referência

CVE-2019-7439

CVE-2019-7439—

cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices allows a DoS (Hang) via the mask POST parameter.

23RISCO

abrir ↗

Referência

CVE-2009-4086

CVE-2009-4086—

CRLF injection vulnerability in Xerver HTTP Server 4.31 and 4.32 allows remote attackers to inject arbitrary HTTP header

23RISCO

abrir ↗

Referência✓ VexDay Proof

Monster Top List 1.4.2 - 'functions.php?root_path' Remote File Inclusion

CVE-2006-1781—webappsphp

PHP remote file inclusion vulnerability in functions.php in Circle R Monster Top List (MTL) 1.4 allows remote attackers

23RISCO

abrir ↗

Referência✓ VexDay Proof

opensurveypilot 1.2.1 - Remote File Inclusion

CVE-2007-2166—webappsphp

PHP remote file inclusion vulnerability in administration/user/lib/group.inc.php in OpenSurveyPilot (osp) 1.2.1 and earl

23RISCO

abrir ↗

Referência✓ VexDay Proof

The Personal FTP Server 6.0f - RETR Denial of Service

CVE-2008-4136—doswindows

Michael Roth Software Personal FTP Server (PFT) 6.0f allows remote attackers to cause a denial of service (service crash

23RISCO

abrir ↗

Referência

CVE-2010-4821

CVE-2010-4821—

Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.6.9 allows remote attackers to inject arbitrary web script

23RISCO

abrir ↗

Referência

CVE-2010-1947

CVE-2010-1947—

Directory traversal vulnerability in scr/soustab.php in openMairie Openregistrecil 1.02, when register_globals is enable

23RISCO

abrir ↗

Referência

CVE-2010-1947

CVE-2010-1947—

Directory traversal vulnerability in scr/soustab.php in openMairie Openregistrecil 1.02, when register_globals is enable

23RISCO

abrir ↗

Referência

Veyon 4.4.1 - 'VeyonService' Unquoted Service Path

CVE-2020-15261HIGHlocalwindows

Unquoted service path vulnerability on Veyon

46RISCO

abrir ↗

Referência

CVE-2014-9178

CVE-2014-9178—

Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plu

23RISCO

abrir ↗

Referência

CVE-2014-9175

CVE-2014-9175—

SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote

23RISCO

abrir ↗

Referência

CVE-2014-9175

CVE-2014-9175—

SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote

23RISCO

abrir ↗

Referência

CVE-2012-1002

CVE-2012-1002—

SQL injection vulnerability in author/edit.php in OpenConf 4.x before 4.12 allows remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência

CVE-2015-2216

CVE-2015-2216—

SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to exec

23RISCO

abrir ↗

Referência

CVE-2015-2216

CVE-2015-2216—

SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to exec

23RISCO

abrir ↗

Referência

CVE-2015-2090

CVE-2015-2090—

SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 fo

23RISCO

abrir ↗

Referência

CVE-2015-2090

CVE-2015-2090—

SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 fo

23RISCO

abrir ↗

Referência

CVE-2014-10013

CVE-2014-10013—

SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to

23RISCO

abrir ↗

Referência

CVE-2014-10013

CVE-2014-10013—

SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to

23RISCO

abrir ↗

Referência✓ VexDay Proof

Sphider 1.3 - 'configset.php' Remote File Inclusion

CVE-2006-1784—webappsphp

PHP remote file inclusion vulnerability in admin/configset.php in Sphider 1.3 and earlier, when register_globals is disa

23RISCO

abrir ↗

Referência

CVE-2012-2276

CVE-2012-2276—

The IRM Server in EMC Documentum Information Rights Management 4.x before 4.7.0100 and 5.x before 5.0.1030 allows remote

23RISCO

abrir ↗

Referência

CVE-2017-18195

CVE-2017-18195—

An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enum

28RISCO

abrir ↗

Referência

CVE-2013-6793

CVE-2013-6793—

Multiple cross-site scripting (XSS) vulnerabilities in the Calendar module in Olat 7.8.0.1 (b20130821 N1) allow remote a

23RISCO

abrir ↗

Referência

CVE-2015-4667

CVE-2015-4667—

Multiple hardcoded credentials in Xsuite 2.x.

28RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.