Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

76.008exploits catalogados

34.638CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.443Referência 21.662GitHub PoC 13.743VulnCheck XDB 8.460Nuclei 4.233Metasploit 3.467✓ só verificadosrecentes populares risco

21.662 exploits

Referência

CVE-2014-0793

CVE-2014-0793—

Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for J

23RISCO

abrir ↗

Referência

CVE-2014-10018

CVE-2014-10018—

Cross-site scripting (XSS) vulnerability in webconfig/wlan/country.html/country in the Teracom T2-B-Gawv1.4U10Y-BI modem

23RISCO

abrir ↗

Referência

CVE-2010-1146

CVE-2010-1146—

The Linux kernel 2.6.33.2 and earlier, when a ReiserFS filesystem exists, does not restrict read or write access to the

23RISCO

abrir ↗

Referência

CVE-2012-2592

CVE-2012-2592—

Cross-site scripting (XSS) vulnerability in Axigen Mail Server 8.0.1 allows remote attackers to inject arbitrary web scr

23RISCO

abrir ↗

Referência

CVE-2012-2569

CVE-2012-2569—

Cross-site scripting (XSS) vulnerability in Synametrics Technologies Xeams 4.4 Build 5720 allows remote attackers to inj

23RISCO

abrir ↗

Referência

CVE-2026-5995

CVE-2026-5995CRITICAL

Totolink A7100RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection

48RISCO

abrir ↗

Referência

CVE-2026-10182

CVE-2026-10182MEDIUM

TRENDnet TEW-432BRP formWlanSetup command injection

33RISCO

abrir ↗

Referência

CVE-2026-5996

CVE-2026-5996CRITICAL

Totolink A7100RU CGI cstecgi.cgi setAdvancedInfoShow os command injection

48RISCO

abrir ↗

Referência

CVE-2010-0678

CVE-2010-0678—

PHP remote file inclusion vulnerability in includes/moderation.php in Katalog Stron Hurricane 1.3.5, and possibly earlie

23RISCO

abrir ↗

Referência

CVE-2010-0678

CVE-2010-0678—

PHP remote file inclusion vulnerability in includes/moderation.php in Katalog Stron Hurricane 1.3.5, and possibly earlie

23RISCO

abrir ↗

Referência✓ VexDay Proof

Guestbara 1.2 - Change Admin Login and Password

CVE-2007-1553—webappsphp

admin/configuration.php in Guestbara 1.2 and earlier allows remote attackers to modify the e-mail, name, and password of

23RISCO

abrir ↗

Referência✓ VexDay Proof

Free Directory Script 1.1.1 - 'API_HOME_DIR' Remote File Inclusion

CVE-2008-6305—webappsphp

PHP remote file inclusion vulnerability in init.php in Free Directory Script 1.1.1, when register_globals is enabled, al

23RISCO

abrir ↗

Referência✓ VexDay Proof

Anata CMS 1.0b5 - 'change.php' Arbitrary Add Admin

CVE-2008-6665—webappsphp

change.php in Ananta CMS 1.0b5, with magic_quotes_gpc disabled, allows remote attackers to gain administrator privileges

23RISCO

abrir ↗

Referência

CVE-2012-5700

CVE-2012-5700—

Multiple cross-site scripting (XSS) vulnerabilities in Baby Gekko before 1.2.2f allow remote attackers to inject arbitra

23RISCO

abrir ↗

Referência

CVE-2024-25003

CVE-2024-25003HIGH

KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insuf

41RISCO

abrir ↗

Referência

CVE-2024-25003

CVE-2024-25003HIGH

KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insuf

41RISCO

abrir ↗

Referência

CVE-2017-11320

CVE-2017-11320—

Persistent XSS through the SSID of nearby Wi-Fi devices on Technicolor TC7337 routers 08.89.17.20.00 allows an attacker

23RISCO

abrir ↗

Referência

CVE-2021-24272

CVE-2021-24272—

Fitness Calculators < 1.9.6 - Cross-Site Request Forgery to Cross-Site Scripting (XSS)

23RISCO

abrir ↗

Referência

CVE-2016-2188

CVE-2016-2188—

The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel before 4.5.1 allows physically proximat

23RISCO

abrir ↗

Referência

CVE-2012-2938

CVE-2012-2938—

Multiple cross-site scripting (XSS) vulnerabilities in Travelon Express 6.2.2 allow remote attackers to inject arbitrary

23RISCO

abrir ↗

Referência

CVE-2010-5048

CVE-2010-5048—

Cross-site scripting (XSS) vulnerability in admin.jcomments.php in the JoomlaTune JComments (com_jcomments) component 2.

23RISCO

abrir ↗

Referência

CVE-2015-2999

CVE-2015-2999—

Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary

23RISCO

abrir ↗

Referência

CVE-2023-3897

CVE-2023-3897MEDIUM

Bypassing CAPTCHA & Enumerating Usernames via Password Reset Page

33RISCO

abrir ↗

Referência✓ VexDay Proof

Alstrasoft e-Friends 4.21 - Admin Session Retrieve

CVE-2007-2824—webappsphp

SQL injection vulnerability in paypal.php in AlstraSoft E-Friends 4.21 and earlier allows remote attackers to execute ar

23RISCO

abrir ↗

Referência✓ VexDay Proof

Interact 2.4.1 - Multiple Remote File Inclusions

CVE-2008-2220—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Interact Learning Community Environment Interact 2.4.1, when regis

23RISCO

abrir ↗

Referência✓ VexDay Proof

cmsWorks 2.2 RC4 - 'mod_root' Remote File Inclusion

CVE-2008-2877—webappsphp

PHP remote file inclusion vulnerability in admin/include/lib.module.php in cmsWorks 2.2 RC4, when register_globals is en

23RISCO

abrir ↗

Referência

CVE-2017-8422

CVE-2017-8422—

KDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain root privileges by spoofing a callerID and le

23RISCO

abrir ↗

Referência

CVE-2010-3490

CVE-2010-3490—

Directory traversal vulnerability in page.recordings.php in the System Recordings component in the configuration interfa

23RISCO

abrir ↗

Referência

CVE-2012-1787

CVE-2012-1787—

Multiple cross-site scripting (XSS) vulnerabilities in wgarcmin.cgi in Webglimpse 2.20.0 and earlier allow remote attack

23RISCO

abrir ↗

Referência

CVE-2009-3360

CVE-2009-3360—

Multiple cross-site scripting (XSS) vulnerabilities in Datemill 1.0 allow remote attackers to inject arbitrary web scrip

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.