Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

76.008exploits catalogados

34.638CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.443Referência 21.662GitHub PoC 13.743VulnCheck XDB 8.460Nuclei 4.233Metasploit 3.467✓ só verificadosrecentes populares risco

21.662 exploits

Referência✓ VexDay Proof

LimeSurvey 1.52 - 'language.php' Remote File Inclusion

CVE-2007-5573—webappsphp

PHP remote file inclusion vulnerability in classes/core/language.php in LimeSurvey 1.5.2 and earlier allows remote attac

23RISCO

abrir ↗

Referência✓ VexDay Proof

MyForum 1.3 - Insecure Cookie Handling

CVE-2008-5040—webappsphp

Graphiks MyForum 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the (1)

23RISCO

abrir ↗

Referência✓ VexDay Proof

Ninja Blog 4.8 - Remote Information Disclosure

CVE-2009-0325—webappsphp

Directory traversal vulnerability in entries/index.php in Ninja Blog 4.8, when magic_quotes_gpc is disabled, allows remo

23RISCO

abrir ↗

Referência✓ VexDay Proof

phpYabs 0.1.2 - 'Azione' Remote File Inclusion

CVE-2009-0639—webappsphp

PHP remote file inclusion vulnerability in moduli/libri/index.php in phpyabs 0.1.2 allows remote attackers to execute ar

23RISCO

abrir ↗

Referência

CVE-2014-5520

CVE-2014-5520—

SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via

23RISCO

abrir ↗

Referência

CVE-2022-40797

CVE-2022-40797CRITICAL

Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.

48RISCO

abrir ↗

Referência

CVE-2014-3871

CVE-2014-3871—

Multiple SQL injection vulnerabilities in register.php in Geodesic Solutions GeoCore MAX 7.3.3 (formerly GeoClassifieds

23RISCO

abrir ↗

Referência

CVE-2020-5147

CVE-2020-5147—

SonicWall NetExtender Windows client vulnerable to unquoted service path vulnerability, this allows a local attacker to

23RISCO

abrir ↗

Referência

CVE-2012-4998

CVE-2012-4998—

Cross-site scripting (XSS) vulnerability in index.php in starCMS allows remote attackers to inject arbitrary web script

23RISCO

abrir ↗

Referência

CVE-2008-0843

CVE-2008-0843—

StatCounteX 3.0 and 3.1 allows remote attackers to obtain sensitive information and edit configuration scripts via a dir

23RISCO

abrir ↗

Referência

CVE-2008-0843

CVE-2008-0843—

StatCounteX 3.0 and 3.1 allows remote attackers to obtain sensitive information and edit configuration scripts via a dir

23RISCO

abrir ↗

Referência

CVE-2010-2512

CVE-2010-2512—

SQL injection vulnerability in customprofile.php in 2daybiz Matrimonial Script allows remote attackers to execute arbitr

23RISCO

abrir ↗

Referência

CVE-2016-3652

CVE-2016-3652—

Multiple cross-site scripting (XSS) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM)

23RISCO

abrir ↗

Referência

CVE-2009-4447

CVE-2009-4447—

Jax Guestbook 3.5.0 allows remote attackers to bypass authentication and modify administrator settings via a direct requ

23RISCO

abrir ↗

Referência

CVE-2016-1000124

CVE-2016-1000124—

Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Plugin v1.0.6

23RISCO

abrir ↗

Referência

CVE-2015-6512

CVE-2015-6512—

SQL injection vulnerability in the get_messages function in server/plugins/chatroom/chatroom.php in FreiChat 9.6 allows

23RISCO

abrir ↗

Referência

CVE-2015-6512

CVE-2015-6512—

SQL injection vulnerability in the get_messages function in server/plugins/chatroom/chatroom.php in FreiChat 9.6 allows

23RISCO

abrir ↗

Referência

CVE-2011-4674

CVE-2011-4674—

SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows rem

23RISCO

abrir ↗

Referência

CVE-2019-16531

CVE-2019-16531—

LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.

23RISCO

abrir ↗

Referência

CVE-2023-34723

CVE-2023-34723—

An issue was discovered in TechView LA-5570 Wireless Gateway 1.0.19_T53, allows attackers to gain sensitive information

23RISCO

abrir ↗

Referência✓ VexDay Proof

Light Weight Calendar 1.x - 'date' Remote Code Execution

CVE-2006-1252—webappsphp

Eval injection vulnerability in cal.php in Light Weight Calendar (LWC) 1.0 allows remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência✓ VexDay Proof

Yahoo! Messenger 8.1.0.421 - CYFT Object Arbitrary File Download

CVE-2007-5017—remotewindows

Absolute path traversal vulnerability in a certain ActiveX control in the CYFT object in ft60.dll in Yahoo! Messenger 8.

23RISCO

abrir ↗

Referência✓ VexDay Proof

ezcms 1.2 - Blind SQL Injection / Authentication Bypass

CVE-2008-2920—webappsphp

admin/filemanager/ (aka the File Manager) in EZTechhelp EZCMS 1.2 and earlier does not require authentication, which all

23RISCO

abrir ↗

Referência✓ VexDay Proof

Calendar Script 1.1 - Insecure Cookie Handling

CVE-2008-5738—webappsphp

Nodstrum MySQL Calendar 1.1 and 1.2 allows remote attackers to bypass authentication and gain administrative access by s

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHPAuctionSystem - Insecure Cookie Handling

CVE-2009-0108—webappsphp

PHPAuctions (aka PHPAuctionSystem) allows remote attackers to bypass authentication and gain administrative access via m

23RISCO

abrir ↗

Referência

CVE-2010-2622

CVE-2010-2622—

SQL injection vulnerability in the Joomanager component, possibly 1.1.1, for Joomla! allows remote attackers to execute

23RISCO

abrir ↗

Referência

CVE-2010-2623

CVE-2010-2623—

SQL injection vulnerability in pages.php in Internet DM Specialist Bed and Breakfast allows remote attackers to execute

23RISCO

abrir ↗

Referência

CVE-2010-2670

CVE-2010-2670—

SQL injection vulnerability in recipedetail.php in BrotherScripts Recipe Website allows remote attackers to execute arbi

23RISCO

abrir ↗

Referência

CVE-2010-2673

CVE-2010-2673—

SQL injection vulnerability in profile_view.php in Devana 1.6.6 and earlier allows remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência

CVE-2010-2673

CVE-2010-2673—

SQL injection vulnerability in profile_view.php in Devana 1.6.6 and earlier allows remote attackers to execute arbitrary

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.