Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

76.107exploits catalogados

34.679CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.443Referência 21.692GitHub PoC 13.812VulnCheck XDB 8.460Nuclei 4.233Metasploit 3.467✓ só verificadosrecentes populares risco

21.662 exploits

Referência✓ VexDay Proof

AlkalinePHP 0.77.35 - 'adduser.php' Arbitrary Add Admin

CVE-2008-2346—webappsphp

AlkalinePHP 0.77.35 and earlier allows remote attackers to bypass authentication and gain administrative access by creat

23RISCO

abrir ↗

Referência✓ VexDay Proof

Tlnews 2.2 - Insecure Cookie Handling

CVE-2008-4752—webappsphp

TlNews 2.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlNews_login c

23RISCO

abrir ↗

Referência

CVE-2018-5978

CVE-2018-5978—

SQL Injection exists in Facebook Style Php Ajax Chat Zechat 1.5 via the login.php User field.

23RISCO

abrir ↗

Referência✓ VexDay Proof

TorrentTrader Classic 1.09 - Multiple Vulnerabilities

CVE-2009-2159—webappsphp

backup-database.php in TorrentTrader Classic 1.09 does not require administrative authentication, which allows remote at

23RISCO

abrir ↗

Referência

CVE-2018-6395

CVE-2018-6395—

SQL Injection exists in the Visual Calendar 3.1.3 component for Joomla! via the id parameter in a view=load action.

23RISCO

abrir ↗

Referência

CVE-2018-6398

CVE-2018-6398—

SQL Injection exists in the CP Event Calendar 3.0.1 component for Joomla! via the id parameter in a task=load action.

23RISCO

abrir ↗

Referência

CVE-2023-0904

CVE-2023-0904MEDIUM

SourceCodester Employee Task Management System task-details.php sql injection

33RISCO

abrir ↗

Referência✓ VexDay Proof

OPT Max 1.2.0 - 'CRM_inc' Remote File Inclusion

CVE-2006-4239—webappsphp

PHP remote file inclusion vulnerability in include/urights.php in Outreach Project Tool (OPT) Max 1.2.6 and earlier allo

23RISCO

abrir ↗

Referência

CVE-2021-36520

CVE-2021-36520HIGH

A SQL injection vulnerability in I-Tech Trainsmart r1044 exists via a evaluation/assign-evaluation?id= URI.

41RISCO

abrir ↗

Referência✓ VexDay Proof

phpFullAnnu 5.1 - 'repmod' Remote File Inclusion

CVE-2006-4644—webappsphp

PHP remote file inclusion vulnerability in modules/home.module.php in phpFullAnnu 5.1 and earlier allows remote attacker

23RISCO

abrir ↗

Referência

CVE-2018-8584

CVE-2018-8584—

An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (A

23RISCO

abrir ↗

Referência✓ VexDay Proof

Star FTP Server 1.10 - 'RETR' Remote Denial of Service

CVE-2006-6643—doswindows

Fightersoft Multimedia Star FTP server 1.10 allows remote attackers to cause a denial of service (crash) via multiple RE

23RISCO

abrir ↗

Referência

CVE-2023-0902

CVE-2023-0902LOW

SourceCodester Simple Food Ordering System process_order.php cross site scripting

28RISCO

abrir ↗

Referência✓ VexDay Proof

photokron 1.7 - Remote Database Disclosure

CVE-2008-0297—webappsphp

PhotoKorn allows remote attackers to obtain database credentials via a direct request to update/update3.php, which inclu

23RISCO

abrir ↗

Referência✓ VexDay Proof

BolinOS 4.6.1 - Local File Inclusion / Cross-Site Scripting

CVE-2008-1557—webappsphp

BolinOS 4.6.1 allows remote attackers to obtain sensitive information via a direct request to system/actionspages/_b/con

23RISCO

abrir ↗

Referência✓ VexDay Proof

FREEze Greetings 1.0 - Remote Password Retrieve

CVE-2008-5218—webappsphp

ScriptsEz FREEze Greetings 1.0 stores pwd.txt under the web root with insufficient access control, which allows remote a

23RISCO

abrir ↗

Referência✓ VexDay Proof

Noticeware E-mail Server 5.1.2.2 - 'POP3' Denial of Service

CVE-2008-6185—doswindows

NoticeWare Email Server NG 5.1.2.2 allows remote attackers to cause a denial of service (crash) via multiple POP3 reques

23RISCO

abrir ↗

Referência

CVE-2014-9099

CVE-2014-9099—

Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attacker

23RISCO

abrir ↗

Referência

CVE-2017-14843

CVE-2017-14843—

Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.

23RISCO

abrir ↗

Referência

CVE-2017-14842

CVE-2017-14842—

Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.

23RISCO

abrir ↗

Referência

CVE-2018-11715

CVE-2018-11715—

The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject.

23RISCO

abrir ↗

Referência

CVE-2023-26692

CVE-2023-26692MEDIUM

ZCBS Zijper Collectie Beheer Systeem (ZCBS), Zijper Publication Management System (ZPBS), and Zijper Image Bank Manageme

33RISCO

abrir ↗

Referência

CVE-2014-2088

CVE-2014-2088—

Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrar

23RISCO

abrir ↗

Referência

CVE-2014-3991

CVE-2014-3991—

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary

23RISCO

abrir ↗

Referência

CVE-2011-3645

CVE-2011-3645—

Newgen OmniDocs allows remote attackers to bypass intended access restrictions via (1) a modified FolderRights parameter

23RISCO

abrir ↗

Referência

CVE-2010-0799

CVE-2010-0799—

Directory traversal vulnerability in misc/tell_a_friend/tell.php in phpunity.newsmanager allows remote attackers to read

23RISCO

abrir ↗

Referência

CVE-2010-0799

CVE-2010-0799—

Directory traversal vulnerability in misc/tell_a_friend/tell.php in phpunity.newsmanager allows remote attackers to read

23RISCO

abrir ↗

Referência

CVE-2010-2677

CVE-2010-2677—

PHP remote file inclusion vulnerability in mw_plugin.php in Open Web Analytics (OWA) 1.2.3, when magic_quotes_gpc is dis

23RISCO

abrir ↗

Referência

CVE-2010-2677

CVE-2010-2677—

PHP remote file inclusion vulnerability in mw_plugin.php in Open Web Analytics (OWA) 1.2.3, when magic_quotes_gpc is dis

23RISCO

abrir ↗

Referência✓ VexDay Proof

V-Webmail 1.6.4 - 'pear_dir' Remote File Inclusion

CVE-2006-2666—webappsphp

PHP remote file inclusion vulnerability in includes/mailaccess/pop3.php in V-Webmail 1.5 through 1.6.4 allows remote att

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.