Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

76.107exploits catalogados

34.679CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.443Referência 21.692GitHub PoC 13.812VulnCheck XDB 8.460Nuclei 4.233Metasploit 3.467✓ só verificadosrecentes populares risco

21.662 exploits

Referência

CVE-2018-11479

CVE-2018-11479—

The VPN component in Windscribe 1.81 uses the OpenVPN client for connections. Also, it creates a WindScribeService.exe s

38RISCO

abrir ↗

Referência

CVE-2025-34077

CVE-2025-34077CRITICAL

WordPress Pie Register Plugin ≤ 3.7.1.4 Authentication Bypass RCE

63RISCO

abrir ↗

Referência

CVE-2025-34077

CVE-2025-34077CRITICAL

WordPress Pie Register Plugin ≤ 3.7.1.4 Authentication Bypass RCE

63RISCO

abrir ↗

Referência

CVE-2015-1130

CVE-2015-1130HIGHsob ataque

The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and o

86RISCO

abrir ↗

Referência

CVE-2026-6590

CVE-2026-6590MEDIUM

ComfyUI Model Preview Endpoint model_manager.py get_model_preview path traversal

33RISCO

abrir ↗

Referência

i-doit CMDB 1.11.2 - Remote Code Execution

CVE-2018-20159—webappsphp

i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allow

23RISCO

abrir ↗

Referência

CVE-2023-27100

CVE-2023-27100CRITICAL

Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22

48RISCO

abrir ↗

Referência

CVE-2023-27100

CVE-2023-27100CRITICAL

Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22

48RISCO

abrir ↗

Referência

CVE-2016-5399

CVE-2016-5399—

The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attac

23RISCO

abrir ↗

Referência

CVE-2016-5399

CVE-2016-5399—

The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attac

23RISCO

abrir ↗

Referência

CVE-2009-4974

CVE-2009-4974—

Directory traversal vulnerability in box_display.php in TotalCalendar 2.4 allows remote attackers to read arbitrary file

23RISCO

abrir ↗

Referência

CVE-2019-16294

CVE-2019-16294—

SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode ch

23RISCO

abrir ↗

Referência

CVE-2014-1982

CVE-2014-1982—

The administrative interface in Allied Telesis AT-RG634A ADSL Broadband router 3.3+, iMG624A firmware 3.5, iMG616LH firm

23RISCO

abrir ↗

Referência✓ VexDay Proof

WiClear 0.10 - 'path' Remote File Inclusion

CVE-2006-5506—webappsphp

Multiple PHP remote file inclusion vulnerabilities in WiClear 0.10 allow remote attackers to execute arbitrary PHP code

28RISCO

abrir ↗

Referência

CVE-2016-8526

CVE-2016-8526—

Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE). XXEs are a

23RISCO

abrir ↗

Referência

CVE-2018-9038

CVE-2018-9038—

Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&delete_dir=./&path=uplo

23RISCO

abrir ↗

Referência

CVE-2018-8813

CVE-2018-8813—

Open redirect vulnerability in the login[redirect] parameter login functionality in WolfCMS 0.8.3.1 allows remote attack

23RISCO

abrir ↗

Referência✓ VexDay Proof

Ventrilo 3.0.2 - Null Pointer Remote Denial of Service

CVE-2008-3680—dosmultiple

The decryption function in Flagship Industries Ventrilo 3.0.2 and earlier allows remote attackers to cause a denial of s

23RISCO

abrir ↗

Referência

CVE-2019-13358

CVE-2019-13358—

lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying opera

28RISCO

abrir ↗

Referência✓ VexDay Proof

GoodTech SSH - 'SSH_FXP_OPEN' Remote Buffer Overflow

CVE-2008-4726—remotewindows

Stack-based buffer overflow in the SFTP subsystem in GoodTech SSH 6.4 allows remote authenticated users to execute arbit

35RISCO

abrir ↗

Referência

CVE-2022-38840

CVE-2022-38840HIGH

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file uplo

56RISCO

abrir ↗

Referência

CVE-2019-7181

CVE-2019-7181—

Buffer Overflow vulnerability in myQNAPcloud Connect 1.3.3.0925 and earlier could allow remote attackers to crash the pr

23RISCO

abrir ↗

Referência

CVE-2019-7181

CVE-2019-7181—

Buffer Overflow vulnerability in myQNAPcloud Connect 1.3.3.0925 and earlier could allow remote attackers to crash the pr

23RISCO

abrir ↗

Referência

CVE-2017-9872

CVE-2017-9872—

The III_dequantize_sample function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products,

23RISCO

abrir ↗

Referência

Savsoft Quiz 5 - Stored Cross-Site Scripting

CVE-2020-24609—webappsphp

TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the X

23RISCO

abrir ↗

Referência✓ VexDay Proof

SunOS Release 5.11 snv_101b - Remote IPv6 Crash

CVE-2009-0304—dossolaris

The kernel in Sun Solaris 10 and 11 snv_101b, and OpenSolaris before snv_108, allows remote attackers to cause a denial

23RISCO

abrir ↗

Referência

CVE-2016-4535

CVE-2016-4535—

Integer signedness error in the AV engine before DAT 8145, as used in McAfee LiveSafe 14.0, allows remote attackers to c

23RISCO

abrir ↗

Referência

CVE-2016-4535

CVE-2016-4535—

Integer signedness error in the AV engine before DAT 8145, as used in McAfee LiveSafe 14.0, allows remote attackers to c

23RISCO

abrir ↗

Referência

CVE-2014-4663

CVE-2014-4663—

TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência

CVE-2014-4663

CVE-2014-4663—

TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.