Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

75.900exploits catalogados

34.597CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.443Referência 21.624GitHub PoC 13.725VulnCheck XDB 8.410Nuclei 4.231Metasploit 3.467✓ só verificadosrecentes populares risco

21.581 exploits

Referência✓ VexDay Proof

chCounter 3.1.3 - Authentication Bypass

CVE-2009-1347—webappsphp

Multiple SQL injection vulnerabilities in stats/index.php in chCounter 3.1.3 allow remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência✓ VexDay Proof

CRE Loaded 6.2 - 'products_id' SQL Injection

CVE-2009-1403—webappsphp

SQL injection vulnerability in product_info.php in CRE Loaded 6.2 allows remote attackers to execute arbitrary SQL comma

23RISCO

abrir ↗

Referência

CVE-2011-5207

CVE-2011-5207—

Cross-site scripting (XSS) vulnerability in admin/OptionsPostsList.php in the TheCartPress plugin for WordPress before 1

23RISCO

abrir ↗

Referência✓ VexDay Proof

pastelcms 0.8.0 - Local File Inclusion / SQL Injection

CVE-2009-1404—webappsphp

SQL injection vulnerability in admin.php in PastelCMS 0.8.0, when magic_quotes_gpc is disabled, allows remote attackers

23RISCO

abrir ↗

Referência✓ VexDay Proof

TotalCalendar 2.4 - 'Include' Local File Inclusion

CVE-2009-1406—webappsphp

Directory traversal vulnerability in cms_detect.php in TotalCalendar 2.4 allows remote attackers to include and execute

23RISCO

abrir ↗

Referência✓ VexDay Proof

e107 < 0.7.15 - 'extended_user_fields' Blind SQL Injection

CVE-2009-1409—webappsphp

SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and m

23RISCO

abrir ↗

Referência

CVE-2021-47952

CVE-2021-47952CRITICAL

python jsonpickle 2.0.0 Remote Code Execution via py/repr

48RISCO

abrir ↗

Referência✓ VexDay Proof

Quick.CMS.Lite 0.5 - 'id' SQL Injection

CVE-2009-1410—webappsphp

SQL injection vulnerability in index.php in Quick.Cms.Lite 0.5 allows remote attackers to execute arbitrary SQL commands

23RISCO

abrir ↗

Referência

CVE-2021-47934

CVE-2021-47934MEDIUM

MyBB Timeline Plugin 1.0 Cross-Site Scripting and CSRF

33RISCO

abrir ↗

Referência

CVE-2020-37247

CVE-2020-37247HIGH

Kite 4.2.0.1 U1 Unquoted Service Path Privilege Escalation

41RISCO

abrir ↗

Referência

CVE-2020-37246

CVE-2020-37246MEDIUM

WordPress Plugin Supsystic Backup 2.3.9 Local File Inclusion

33RISCO

abrir ↗

Referência

CVE-2020-37245

CVE-2020-37245HIGH

WordPress Plugin Supsystic Digital Publications 1.6.9 Path Traversal XSS

41RISCO

abrir ↗

Referência

CVE-2020-37240

CVE-2020-37240MEDIUM

Queue Management System 4.0.0 Stored XSS via Add User

33RISCO

abrir ↗

Referência

CVE-2020-37239

CVE-2020-37239CRITICAL

libbabl 0.1.62 Broken Double Free Detection Memory Safety

48RISCO

abrir ↗

Referência

CVE-2020-37238

CVE-2020-37238MEDIUM

CMS Made Simple 2.2.15 Stored XSS via SVG File Upload

33RISCO

abrir ↗

Referência

CVE-2020-37237

CVE-2020-37237MEDIUM

Composr CMS 10.0.34 Persistent Cross-Site Scripting via banners

33RISCO

abrir ↗

Referência

CVE-2020-37236

CVE-2020-37236MEDIUM

NewsLister Authenticated Persistent Cross-Site Scripting via Admin Panel

33RISCO

abrir ↗

Referência

CVE-2020-37235

CVE-2020-37235MEDIUM

WordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Component

33RISCO

abrir ↗

Referência

CVE-2020-37234

CVE-2020-37234MEDIUM

Internet Download Manager 6.38.12 Scheduler Buffer Overflow

33RISCO

abrir ↗

Referência

CVE-2020-37233

CVE-2020-37233MEDIUM

WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting

33RISCO

abrir ↗

Referência

CVE-2026-16484

CVE-2026-16484MEDIUM

SourceCodester Class and Exam Timetabling System edit_subjecta.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-42881

CVE-2026-42881HIGH

STIGQter: Arbitrary File Write leading to Local Code Execution via Export HTML

41RISCO

abrir ↗

Referência

CVE-2016-20096

CVE-2016-20096CRITICAL

Linknat VOS3000/VOS2009 2.1.2.0 SQL Injection via login.jsp

48RISCO

abrir ↗

Referência

CVE-2026-8082

CVE-2026-8082HIGH

Bpost Shipping Platform < 3.2.3 - Unauthenticated SQL Injection

41RISCO

abrir ↗

Referência

CVE-2026-14185

CVE-2026-14185MEDIUM

WPBot AI ChatBot < 8.2.0 - Subscriber+ RAG Settings Update

33RISCO

abrir ↗

Referência

CVE-2026-43644

CVE-2026-43644MEDIUM

podinfo 6.11.2 Reflected XSS via /echo Endpoint

33RISCO

abrir ↗

Referência

CVE-2026-13147

CVE-2026-13147CRITICAL

Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis

48RISCO

abrir ↗

Referência

CVE-2026-13142

CVE-2026-13142HIGH

Passwordless Login by VentraConnect < 1.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force

41RISCO

abrir ↗

Referência

CVE-2026-12973

CVE-2026-12973MEDIUM

PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification

33RISCO

abrir ↗

Referência✓ VexDay Proof

TemaTres 1.0.3 - Blind SQL Injection

CVE-2009-1584—webappsphp

Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magic_quotes_gpc is disabled, allow remote atta

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.