Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

76.107exploits catalogados

34.679CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.443Referência 21.692GitHub PoC 13.812VulnCheck XDB 8.460Nuclei 4.233Metasploit 3.467✓ só verificadosrecentes populares risco

21.692 exploits

Referência

CVE-2018-7707

CVE-2018-7707—

Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitr

23RISCO

abrir ↗

Referência

CVE-2004-1722

CVE-2004-1722—

SQL injection vulnerability in calendar.html in Merak Mail Server 5.2.7 allows remote attackers to execute arbitrary SQL

23RISCO

abrir ↗

Referência

CVE-2009-3760

CVE-2009-3760—

Static code injection vulnerability in config/writeconfig.php in the sample code in the XenServer Resource Kit in Citrix

23RISCO

abrir ↗

Referência✓ VexDay Proof

phpListPro 2.0.1 - 'Language' Remote Code Execution

CVE-2006-2523—webappsphp

PHP remote file inclusion vulnerability in config.php in phpListPro 2.0.1 and earlier, with magic_quotes_gpc disabled, a

23RISCO

abrir ↗

Referência✓ VexDay Proof

ACGVAnnu 1.3 - 'acgv.php?rubrik' Local File Inclusion

CVE-2007-2560—webappsphp

Directory traversal vulnerability in theme/acgv.php in ACGVannu 1.3 and earlier allows remote attackers to read arbitrar

23RISCO

abrir ↗

Referência✓ VexDay Proof

Simple HTTPd 1.38 - Multiple Vulnerabilities

CVE-2007-6404—remotewindows

Directory traversal vulnerability in Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attac

23RISCO

abrir ↗

Referência✓ VexDay Proof

WordPress Plugin WP-Cal 0.3 - 'editevent.php' SQL Injection

CVE-2008-0490—webappsphp

SQL injection vulnerability in functions/editevent.php in the WP-Cal 0.3 plugin for WordPress allows remote attackers to

23RISCO

abrir ↗

Referência✓ VexDay Proof

Portail Web PHP 2.5.1.1 - Multiple Inclusion Vulnerabilities

CVE-2008-1068—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Portail Web Php 2.5.1.1 and earlier allow remote attackers to exec

23RISCO

abrir ↗

Referência✓ VexDay Proof

WordPress Plugin Download - 'dl_id' SQL Injection

CVE-2008-1646—webappsphp

SQL injection vulnerability in wp-download.php in the WP-Download 1.2 plugin for WordPress allows remote attackers to ex

23RISCO

abrir ↗

Referência✓ VexDay Proof

HomePH Design 2.10 RC2 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting

CVE-2008-2981—webappsphp

PHP remote file inclusion vulnerability in admin/templates/template_thumbnail.php in HomePH Design 2.10 RC2, when regist

23RISCO

abrir ↗

Referência✓ VexDay Proof

Acc Autos 4.0 - Insecure Cookie Handling

CVE-2008-6292—webappsphp

Acc Autos 4.0 allows remote attackers to bypass authentication and gain administrative access by setting the (1) usernam

23RISCO

abrir ↗

Referência✓ VexDay Proof

AvailScript Jobs Portal Script - (Authenticated) Arbitrary File Upload

CVE-2008-7021—webappsphp

Unrestricted file upload vulnerability in editlogo.php in AvailScript Jobs Portal Script allows remote authenticated use

23RISCO

abrir ↗

Referência✓ VexDay Proof

Popcorn 1.87 - Remote Heap Overflow (PoC)

CVE-2009-1647—doswindows

Heap-based buffer overflow in popcorn.exe in Ultrafunk Popcorn 1.87 allows remote POP3 servers to cause a denial of serv

23RISCO

abrir ↗

Referência

CVE-2010-1309

CVE-2010-1309—

Directory traversal vulnerability in Irmin CMS (formerly Pepsi CMS) 0.6 BETA2 allows remote attackers to read arbitrary

23RISCO

abrir ↗

Referência

CVE-2017-1000366

CVE-2017-1000366—

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin

23RISCO

abrir ↗

Referência

CVE-2017-1000366

CVE-2017-1000366—

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin

23RISCO

abrir ↗

Referência

CVE-2017-1000366

CVE-2017-1000366—

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin

23RISCO

abrir ↗

Referência✓ VexDay Proof

osTicket 1.12 - Persistent Cross-Site Scripting via File Upload

CVE-2019-14748—webappsphp

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upl

23RISCO

abrir ↗

Referência

CVE-2019-14748

CVE-2019-14748—

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upl

23RISCO

abrir ↗

Referência

CVE-2009-2399

CVE-2009-2399—

PHP remote file inclusion vulnerability in dm-albums/template/album.php in DM FileManager 3.9.4, when register_globals i

23RISCO

abrir ↗

Referência

CVE-2009-2769

CVE-2009-2769—

PHP remote file inclusion vulnerability in include/timesheet.php in Ultrize TimeSheet 1.2.2, when register_globals is en

23RISCO

abrir ↗

Referência

CVE-2012-2275

CVE-2012-2275—

Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijac

23RISCO

abrir ↗

Referência

CVE-2012-2275

CVE-2012-2275—

Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijac

23RISCO

abrir ↗

Referência

CVE-2007-1152

CVE-2007-1152—

Multiple directory traversal vulnerabilities in Pyrophobia 2.1.3.1 allow remote attackers to read arbitrary files via a

23RISCO

abrir ↗

Referência

CVE-2009-3124

CVE-2009-3124—

Directory traversal vulnerability in get_message.cgi in QuarkMail allows remote attackers to read arbitrary files via a

23RISCO

abrir ↗

Referência✓ VexDay Proof

e107 0.617 - Cross-Site Scripting Remote Cookie Disclosure

CVE-2005-2327—webappsphp

Cross-site scripting (XSS) vulnerability in e107 0.617 and earlier allows remote attackers to inject arbitrary web scrip

23RISCO

abrir ↗

Referência✓ VexDay Proof

Admbook 1.2.2 - 'x-forwarded-for' Remote Command Execution

CVE-2006-0852—webappsphp

Direct static code injection vulnerability in write.php in Admbook 1.2.2 and earlier allows remote attackers to execute

23RISCO

abrir ↗

Referência✓ VexDay Proof

TR Newsportal 0.36tr1 - 'poll.php' Remote File Inclusion

CVE-2006-2557—webappsphp

PHP remote file inclusion vulnerability in extras/poll/poll.php in Florian Amrhein NewsPortal before 0.37, and TR Newspo

28RISCO

abrir ↗

Referência✓ VexDay Proof

Web Oddity Web Server 0.09b - Directory Traversal

CVE-2007-4726—remotelinux

Directory traversal vulnerability in Web Oddity 0.09b allows remote attackers to read arbitrary files via a .. (dot dot)

23RISCO

abrir ↗

Referência✓ VexDay Proof

SiteBuilderElite 1.2 - Multiple Remote File Inclusions

CVE-2008-1123—webappsphp

Multiple PHP remote file inclusion vulnerabilities in SiteBuilder Elite 1.2 allow remote attackers to execute arbitrary

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.