Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

78.953exploits catalogados
36.205CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.460Referência 22.832GitHub PoC 14.986VulnCheck XDB 8.829Nuclei 4.357Metasploit 3.489✓ só verificadosrecentespopularesrisco
5.629 exploits
Referência✓ VexDay Proof
WebSVN 2.0 - Cross-Site Scripting / File Handling / Code Execution
CVE-2008-5918—webappsphp
Cross-site scripting (XSS) vulnerability in the getParameterisedSelfUrl function in index.php in WebSVN 2.0 and earlier
23RISCO
abrir ↗
Referência✓ VexDay Proof
Umer Inc Songs Portal Script - 'id' SQL Injection
CVE-2008-5921—webappsphp
SQL injection vulnerability in albums.php in Umer Inc Songs Portal allows remote attackers to execute arbitrary SQL comm
23RISCO
abrir ↗
Referência✓ VexDay Proof
Amaya 11.1 - W3C Editor/Browser (defer) Stack Overflow (PoC)
CVE-2009-1209—doswindows
Stack-based buffer overflow in W3C Amaya Web Browser 11.1 allows remote attackers to execute arbitrary code via a script
28RISCO
abrir ↗
Referência✓ VexDay Proof
Philex 0.2.3 - Remote File Inclusion / File Disclosure
CVE-2007-1697—webappsphp
PHP remote file inclusion vulnerability in header.inc.php in Philex 0.2.3 and earlier allows remote attackers to execute
45RISCO
abrir ↗
Referência✓ VexDay Proof
Vivotek Motion Jpeg Control - 'MjpegDecoder.dll 2.0.0.13' Remote Overflow
CVE-2007-3167—remotewindows
Stack-based buffer overflow in the Vivotek Motion Jpeg ActiveX control (aka MjpegControl) in MjpegDecoder.dll 2.0.0.13 a
23RISCO
abrir ↗
Referência✓ VexDay Proof
vsp stats processor 0.45 - 'gamestat.php?gameID' SQL Injection
CVE-2009-1224—webappsphp
SQL injection vulnerability in vsp-core/pub/themes/bismarck/gamestat.php in vsp stats processor 0.45 allows remote attac
23RISCO
abrir ↗
Referência✓ VexDay Proof
ASP-DEV Internal E-Mail System - Authentication Bypass
CVE-2008-5926—webappsasp
Multiple SQL injection vulnerabilities in login.asp in ASP-DEv Internal E-Mail System allow remote attackers to execute
23RISCO
abrir ↗
Referência✓ VexDay Proof
FlexPHPNews 0.0.6 / PRO - Authentication Bypass
CVE-2008-5927—webappsphp
Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPNews 0.0.6 allow remote attackers to execute arb
23RISCO
abrir ↗
Referência✓ VexDay Proof
VP-ASP Shopping Cart 6.50 - Database Disclosure
CVE-2008-5929—webappsasp
VP-ASP Shopping Cart 6.50 stores sensitive information under the web root with insufficient access control, which allows
23RISCO
abrir ↗
Referência✓ VexDay Proof
the net guys aspired2blog - SQL Injection / File Disclosure
CVE-2008-5931—webappsasp
The Net Guys ASPired2Blog stores sensitive information under the web root with insufficient access control, which allows
23RISCO
abrir ↗
Referência✓ VexDay Proof
isweb CMS 3.0 - SQL Injection / Cross-Site Scripting
CVE-2008-5934—webappsphp
SQL injection vulnerability in index.php in CMS ISWEB 3.0 allows remote attackers to execute arbitrary SQL commands via
23RISCO
abrir ↗
Referência✓ VexDay Proof
mini-pub 0.3 - Local Directory Traversal / File Disclosure
CVE-2008-5936—webappsphp
front-end/edit.php in mini-pub 0.3 and earlier allows remote attackers to read files and obtain PHP source code via a fi
23RISCO
abrir ↗
Referência✓ VexDay Proof
Check Point Firewall-1 - PKI Web Service HTTP Header Remote Overflow
CVE-2009-1227—doshardware
NOTE: this issue has been disputed by the vendor. Buffer overflow in the PKI Web Service in Check Point Firewall-1 PKI
23RISCO
abrir ↗
Referência✓ VexDay Proof
Arcadwy Arcade Script - 'Username' Static Cross-Site Scripting
CVE-2009-1228—webappsphp
Cross-site scripting (XSS) vulnerability in register.php in Arcadwy Arcade Script CMS allows remote attackers to inject
23RISCO
abrir ↗
Referência✓ VexDay Proof
ccTiddly 1.7.4 - 'cct_base' Remote File Inclusion
CVE-2008-5949—webappsphp
Multiple PHP remote file inclusion vulnerabilities in ccTiddly 1.7.4 and 1.7.6 allow remote attackers to execute arbitra
23RISCO
abrir ↗
Referência✓ VexDay Proof
template creature - SQL Injection / File Disclosure
CVE-2008-5950—webappsphp
SQL injection vulnerability in media/media_level.asp in ASP Template Creature allows remote attackers to execute arbitra
23RISCO
abrir ↗
Referência✓ VexDay Proof
template creature - SQL Injection / File Disclosure
CVE-2008-5951—webappsphp
ASP Template Creature stores sensitive information under the web root with insufficient access control, which allows rem
23RISCO
abrir ↗
Referência✓ VexDay Proof
KTP Computer Customer Database CMS 1.0 - Blind SQL Injection
CVE-2008-5952—webappsphp
SQL injection vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows re
23RISCO
abrir ↗
Referência✓ VexDay Proof
Active Test 2.1 - 'QuizID' Blind SQL Injection
CVE-2008-5958—webappsasp
Multiple SQL injection vulnerabilities in Active Test 2.1 allow remote attackers to execute arbitrary SQL commands via t
23RISCO
abrir ↗
Referência✓ VexDay Proof
Active Test 2.1 - Authentication Bypass
CVE-2008-5959—webappsasp
Multiple SQL injection vulnerabilities in start.asp in Active Test 2.1 allow remote attackers to execute arbitrary SQL c
23RISCO
abrir ↗
Referência✓ VexDay Proof
isiAJAX 1 - 'praises.php?id' SQL Injection
CVE-2009-0881—webappsphp
SQL injection vulnerability in ejemplo/paises.php in isiAJAX 1 allows remote attackers to execute arbitrary SQL commands
23RISCO
abrir ↗
Referência✓ VexDay Proof
Mozilla Firefox 3.0.x - XML Parser Memory Corruption / Denial of Service (PoC)
CVE-2009-1232—doswindows
Mozilla Firefox 3.0.8 and earlier 3.0.x versions allows remote attackers to cause a denial of service (memory corruption
23RISCO
abrir ↗
Referência✓ VexDay Proof
Gravity GTD 0.4.5 - Local File Inclusion / Remote Code Execution
CVE-2008-5962—webappsphp
Directory traversal vulnerability in library/setup/rpc.php in Gravity Getting Things Done (GTD) 0.4.5 and earlier allows
23RISCO
abrir ↗
Referência✓ VexDay Proof
phpTrafficA 1.4.2 - 'pageid' SQL Injection
CVE-2007-3426—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in phpTrafficA 1.4.2 and earlier allows remote attackers to inject
23RISCO
abrir ↗
Referência✓ VexDay Proof
LokiCMS 0.3.4 - 'index.php' Arbitrary Check File
CVE-2008-5965—webappsphp
Directory traversal vulnerability in index.php in LokiCMS 0.3.4 and earlier, when magic_quotes_gpc is disabled, allows r
23RISCO
abrir ↗
Referência✓ VexDay Proof
PHP iCalendar 2.24 - 'cookie_language' Local File Inclusion / Arbitrary File Upload
CVE-2008-5967—webappsphp
admin/index.php in PHP iCalendar 2.3.4, 2.24, and earlier does not require administrative authentication for an addupdat
23RISCO
abrir ↗
Referência✓ VexDay Proof
SunByte e-Flower - 'id' SQL Injection
CVE-2008-5969—webappsphp
SQL injection vulnerability in popupproduct.php in Sunbyte e-Flower allows remote attackers to execute arbitrary SQL com
23RISCO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component com_bookJoomlas 0.1 - SQL Injection
CVE-2009-1263—webappsphp
SQL injection vulnerability in sub_commententry.php in the BookJoomlas (com_bookjoomlas) component 0.1 for Joomla! allow
23RISCO
abrir ↗
Referência✓ VexDay Proof
Gravity Board X 2.0 Beta - SQL Injection / (Authenticated) Code Execution
CVE-2009-1277—webappsphp
SQL injection vulnerability in index.php in Gravity Board X (GBX) 2.0 BETA allows remote attackers to execute arbitrary
23RISCO
abrir ↗
Referência✓ VexDay Proof
EternalMart Guestbook 1.10 - '/admin/auth.php' Remote File Inclusion
CVE-2003-1314—webappsphp
PHP remote file inclusion vulnerability in admin/auth.php in EternalMart Guestbook (EMGB) 1.1 allows remote attackers to
23RISCO
abrir ↗
← anteriorpágina 21 / 188próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.