Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

75.902exploits catalogados

34.597CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.443Referência 21.624GitHub PoC 13.727VulnCheck XDB 8.410Nuclei 4.231Metasploit 3.467✓ só verificadosrecentes populares risco

21.624 exploits

Referência

CVE-2007-4503

CVE-2007-4503—

SQL injection vulnerability in index.php in the Nice Talk component (com_nicetalk) 0.9.3 and earlier for Joomla! allows

23RISCO

abrir ↗

Referência

CVE-2009-2770

CVE-2009-2770—

PowerUpload 2.4 allows remote attackers to bypass authentication and gain administrative access via a MIME encoded value

23RISCO

abrir ↗

Referência

CVE-2012-1671

CVE-2012-1671—

Directory traversal vulnerability in index.php in phpPaleo 4.8b155 and earlier allows remote attackers to include and ex

23RISCO

abrir ↗

Referência

CVE-2010-3023

CVE-2010-3023—

Multiple cross-site scripting (XSS) vulnerabilities in DiamondList 0.1.6, and possibly earlier, allow remote attackers t

23RISCO

abrir ↗

Referência

CVE-2012-5224

CVE-2012-5224—

PHP remote file inclusion vulnerability in vb/includes/vba_cmps_include_bottom.php in vBadvanced CMPS 3.2.2 and earlier

23RISCO

abrir ↗

Referência

CVE-2014-10029

CVE-2014-10029—

SQL injection vulnerability in profile.php in FluxBB before 1.4.13 and 1.5.x before 1.5.7 allows remote attackers to exe

23RISCO

abrir ↗

Referência

CVE-2017-11830

CVE-2017-11830—

Device Guard in Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allow

23RISCO

abrir ↗

Referência✓ VexDay Proof

IceBB 1.0-rc5 - Remote Code Execution

CVE-2007-1726—webappsphp

Unrestricted file upload vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to upload arbitra

23RISCO

abrir ↗

Referência✓ VexDay Proof

AuraCMS 2.2.2 - '/pages_data.php' Arbitrary Edit/Add/Delete

CVE-2008-3203—webappsphp

js/pages/pages_data.php in AuraCMS 2.2 through 2.2.2 does not perform authentication, which allows remote attackers to a

23RISCO

abrir ↗

Referência✓ VexDay Proof

Crux Gallery 1.32 - Insecure Cookie Handling

CVE-2008-4484—webappsphp

main.php in Crux Gallery 1.32 and earlier allows remote attackers to gain administrative access by setting the name para

23RISCO

abrir ↗

Referência✓ VexDay Proof

Enthusiast 3.1.4 - 'show_joined.php' Remote File Inclusion

CVE-2008-5792—webappsphp

PHP remote file inclusion vulnerability in show_joined.php in Indiscripts Enthusiast 3.1.4, and possibly earlier, allows

23RISCO

abrir ↗

Referência✓ VexDay Proof

TurnkeyForms Local Classifieds - Authentication Bypass

CVE-2008-6302—webappsphp

TurnkeyForms Local Classifieds allows remote attackers to bypass authentication and gain administrative access via a dir

23RISCO

abrir ↗

Referência✓ VexDay Proof

ccTiddly 1.7.4 - 'cct_base' Remote File Inclusion

CVE-2008-5949—webappsphp

Multiple PHP remote file inclusion vulnerabilities in ccTiddly 1.7.4 and 1.7.6 allow remote attackers to execute arbitra

23RISCO

abrir ↗

Referência✓ VexDay Proof

AJ Auction - Authentication Bypass

CVE-2008-6965—webappsphp

AJ Square AJ Auction OOPD, Pro Platinum Skin #1, Pro Platinum Skin #2, and Web 2.0 send a redirect but do not exit when

23RISCO

abrir ↗

Referência

CVE-2010-2508

CVE-2010-2508—

SQL injection vulnerability in user-profile.php in 2daybiz Video Community Portal Script allows remote attackers to exec

23RISCO

abrir ↗

Referência

CVE-2012-6643

CVE-2012-6643—

Multiple SQL injection vulnerabilities in the update_counter function in includes/functions.php in ClipBucket 2.6 allow

23RISCO

abrir ↗

Referência

CVE-2010-2510

CVE-2010-2510—

SQL injection vulnerability in customize.php in 2daybiz Web Template Software allows remote attackers to execute arbitra

23RISCO

abrir ↗

Referência

CVE-2010-2511

CVE-2010-2511—

SQL injection vulnerability in viewnews.php in 2daybiz Multi Level Marketing (MLM) Software allows remote attackers to e

23RISCO

abrir ↗

Referência

CVE-2013-5694

CVE-2013-5694—

SQL injection vulnerability in status/service/acknowledge in Opsview before 4.4.1 allows remote attackers to execute arb

23RISCO

abrir ↗

Referência

CVE-2013-5694

CVE-2013-5694—

SQL injection vulnerability in status/service/acknowledge in Opsview before 4.4.1 allows remote attackers to execute arb

23RISCO

abrir ↗

Referência

CVE-2017-9979

CVE-2017-9979—

On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be t

23RISCO

abrir ↗

Referência

CVE-2017-9979

CVE-2017-9979—

On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be t

23RISCO

abrir ↗

Referência

CVE-2009-5103

CVE-2009-5103—

Cross-site scripting (XSS) vulnerability in ATCOM Netvolution 1.0 ASP allows remote attackers to inject arbitrary web sc

23RISCO

abrir ↗

Referência

CVE-2018-16156

CVE-2018-16156—

In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes u

23RISCO

abrir ↗

Referência

CVE-2017-11823

CVE-2017-11823—

The Microsoft Device Guard on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a security

23RISCO

abrir ↗

Referência✓ VexDay Proof

Explay CMS 2.1 - Insecure Cookie Handling

CVE-2008-6411—webappsphp

Explay CMS 2.1 and earlier allows remote attackers to bypass authentication and gain administrative access by setting th

23RISCO

abrir ↗

Referência✓ VexDay Proof

Vivvo Article Manager 3.2 - 'id' SQL Injection

CVE-2006-4715—webappsphp

SQL injection vulnerability in pdf_version.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 and earl

23RISCO

abrir ↗

Referência✓ VexDay Proof

Enthrallweb eCoupons 1.0 - 'myprofile.asp' Remote Pass Change

CVE-2006-6820—webappsasp

myprofile.asp in Enthrallweb eCoupons does not properly validate the MM_recordId parameter during profile updates, which

23RISCO

abrir ↗

Referência✓ VexDay Proof

Stash 1.0.3 - Insecure Cookie Handling

CVE-2008-4081—webappsphp

admin/login.php in Stash 1.0.3 allows remote attackers to bypass authentication and gain administrative access by settin

23RISCO

abrir ↗

Referência✓ VexDay Proof

Enthrallweb eNews 1.0 - Remote User Pass Change

CVE-2006-6821—webappsasp

myprofile.asp in Enthrallweb eNews does not properly validate the MM_recordId parameter during profile updates, which al

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.