Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

75.652exploits catalogados
34.545CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.443Referência 21.581GitHub PoC 13.708VulnCheck XDB 8.225Nuclei 4.228Metasploit 3.467✓ só verificadosrecentespopularesrisco
21.581 exploits
Referência
CVE-2026-15594
CVE-2026-15594MEDIUM
waooAI waoowaoo Media hash.ts stablePublicIdFromStorageKey improper authorization
33RISCO
abrir ↗
Referência
CVE-2026-13578
CVE-2026-13578MEDIUM
itsourcecode Hospital Management System patientdetail.php sql injection
33RISCO
abrir ↗
Referência
CVE-2026-13574
CVE-2026-13574MEDIUM
llvm llvm-project Bitcode File IntrinsicInst.cpp getBasePtr heap-based overflow
33RISCO
abrir ↗
Referência
CVE-2026-13571
CVE-2026-13571MEDIUM
SourceCodester Simple Food Ordering System cart.php logic error
33RISCO
abrir ↗
Referência
CVE-2026-13569
CVE-2026-13569MEDIUM
weng-xianhu EyouCMS API index.php sql injection
33RISCO
abrir ↗
Referência
CVE-2026-40523
CVE-2026-40523HIGH
FrontAccounting < 2.4.20 SQL Injection via reporting/rep710.php
41RISCO
abrir ↗
Referência
CVE-2026-40524
CVE-2026-40524HIGH
FrontAccounting < 2.4.20 SQL Injection via get_gl_transactions()
41RISCO
abrir ↗
Referência
CVE-2026-13566
CVE-2026-13566MEDIUM
SourceCodester Class and Exam Timetabling System preview3.php sql injection
33RISCO
abrir ↗
Referência
CVE-2026-8379
CVE-2026-8379HIGH
Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Download
41RISCO
abrir ↗
Referência
CVE-2026-8378
CVE-2026-8378MEDIUM
Frontend File Manager Plugin <= 23.6 - Subscriber+ Stored Cross-Site Scripting via File Rename
33RISCO
abrir ↗
Referência
CVE-2026-8172
CVE-2026-8172HIGH
Simple Basic Contact Form <= 20250114 - Reflected XSS
41RISCO
abrir ↗
Referência
CVE-2026-8163
CVE-2026-8163HIGH
Infility Global < 2.15.19 - Subscriber+ SQL Injection via order Parameter
41RISCO
abrir ↗
Referência
CVE-2026-7842
CVE-2026-7842MEDIUM
Infility Global < 2.15.20 - Editor+ SQL Injection via orderby Parameter
33RISCO
abrir ↗
Referência
CVE-2026-39904
CVE-2026-39904HIGH
Gophish 0.12.1 Denial of Service via Office Document Upload
41RISCO
abrir ↗
Referência
CVE-2026-10263
CVE-2026-10263MEDIUM
SourceCodester Computer Repair Shop Management System manage_product.php sql injection
33RISCO
abrir ↗
Referência
CVE-2026-10245
CVE-2026-10245MEDIUM
SourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scripting
33RISCO
abrir ↗
Referência
CVE-2026-10244
CVE-2026-10244MEDIUM
SourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scripting
33RISCO
abrir ↗
Referência
CVE-2026-10243
CVE-2026-10243MEDIUM
code-projects Smart Parking System Admin Endpoint missing authentication
33RISCO
abrir ↗
Referência✓ VexDay Proof
Pre ADS Portal 2.0 - Authentication Bypass / Cross-Site Scripting
CVE-2008-6715—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in Pre ADS Portal 2.0 and earlier allow remote attackers to inject a
23RISCO
abrir ↗
Referência✓ VexDay Proof
Pre ADS Portal 2.0 - Authentication Bypass / Cross-Site Scripting
CVE-2008-6716—webappsphp
homeadmin/adminhome.php in Pre ADS Portal 2.0 and earlier does not require administrative authentication, which allows r
23RISCO
abrir ↗
Referência✓ VexDay Proof
U&M Software Signup 1.1 - Authentication Bypass
CVE-2008-6717—webappsphp
U&M Software Signup 1.0 and 1.1 does not require administrative authentication for all scripts in the admin/ directory,
23RISCO
abrir ↗
Referência✓ VexDay Proof
U&M Software Event Lister 1.0 - Authentication Bypass
CVE-2008-6719—webappsphp
U&M Software Event Lister (aka JustListIt) 1.0 does not require administrative authentication for all scripts in the adm
23RISCO
abrir ↗
Referência✓ VexDay Proof
DELTAScripts PHP Links 1.3 - Authentication Bypass
CVE-2008-6720—webappsphp
SQL injection vulnerability in admin/adm_login.php in DeltaScripts PHP Links 1.3 and earlier allows remote attackers to
23RISCO
abrir ↗
Referência
CVE-2011-5005
CVE-2011-5005—
Unrestricted file upload vulnerability in QuiXplorer 2.3 and earlier allows remote attackers to execute arbitrary code b
23RISCO
abrir ↗
Referência✓ VexDay Proof
AJ Article 1.0 - Authentication Bypass
CVE-2008-6721—webappsphp
SQL injection vulnerability in index.php in AJ Square AJ Article allows remote attackers to execute arbitrary SQL comman
23RISCO
abrir ↗
Referência✓ VexDay Proof
CMScout 2.06 - SQL Injection / Local File Inclusion
CVE-2008-6725—webappsphp
Multiple SQL injection vulnerabilities in CMScout 2.06 allow remote authenticated users to execute arbitrary SQL command
23RISCO
abrir ↗
Referência✓ VexDay Proof
CMScout 2.06 - SQL Injection / Local File Inclusion
CVE-2008-6726—webappsphp
Multiple directory traversal vulnerabilities in CMScout 2.06, when register_globals is enabled, allow remote attackers t
23RISCO
abrir ↗
Referência✓ VexDay Proof
PHPmotion 2.1 - Cross-Site Request Forgery
CVE-2008-6729—webappsphp
Multiple cross-site request forgery (CSRF) vulnerabilities in password.php in PHPmotion 2.1 and earlier allow remote att
23RISCO
abrir ↗
Referência✓ VexDay Proof
Simple Machines Forum (SMF) 1.1.4 - SQL Injection
CVE-2008-6741—webappsphp
SQL injection vulnerability in Load.php in Simple Machines Forum (SMF) 1.1.4 and earlier allows remote attackers to exec
23RISCO
abrir ↗
Referência✓ VexDay Proof
Megacubo 5.0.7 - 'mega://' Remote 'eval()' Injection
CVE-2008-6748—remotewindows
Eval injection vulnerability in Megacubo 5.0.7 allows remote attackers to inject and execute arbitrary PHP code via the
23RISCO
abrir ↗
← anteriorpágina 226 / 720próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.