Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

76.107exploits catalogados

34.679CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.443Referência 21.692GitHub PoC 13.812VulnCheck XDB 8.460Nuclei 4.233Metasploit 3.467✓ só verificadosrecentes populares risco

21.692 exploits

Referência

CVE-2010-1305

CVE-2010-1305—

Directory traversal vulnerability in jinventory.php in the JInventory (com_jinventory) component 1.23.02 and possibly ot

43RISCO

abrir ↗

Referência

CVE-2017-2515

CVE-2017-2515—

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS

23RISCO

abrir ↗

Referência

CVE-2013-2618

CVE-2013-2618—

Cross-site scripting (XSS) vulnerability in editor.php in Network Weathermap before 0.97b allows remote attackers to inj

23RISCO

abrir ↗

Referência

CVE-2013-2618

CVE-2013-2618—

Cross-site scripting (XSS) vulnerability in editor.php in Network Weathermap before 0.97b allows remote attackers to inj

23RISCO

abrir ↗

Referência

CVE-2011-2544

CVE-2011-2544—

Cross-site scripting (XSS) vulnerability in the web interface in Cisco TelePresence System MXP Series F9.1 and earlier a

23RISCO

abrir ↗

Referência

CVE-2017-6371

CVE-2017-6371—

Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string

23RISCO

abrir ↗

Referência

CVE-2017-6371

CVE-2017-6371—

Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string

23RISCO

abrir ↗

Referência

CVE-2014-4166

CVE-2014-4166—

Cross-site scripting (XSS) vulnerability in the song history in SHOUTcast DNAS 2.2.1 allows remote attackers to inject a

23RISCO

abrir ↗

Referência

CVE-2014-4166

CVE-2014-4166—

Cross-site scripting (XSS) vulnerability in the song history in SHOUTcast DNAS 2.2.1 allows remote attackers to inject a

23RISCO

abrir ↗

Referência

CVE-2015-8356

CVE-2015-8356—

Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated u

23RISCO

abrir ↗

Referência

CVE-2023-0963

CVE-2023-0963HIGH

SourceCodester Music Gallery Site POST Request Users.php access control

41RISCO

abrir ↗

Referência

CVE-2011-0887

CVE-2011-0887—

The web management portal on the SMC SMCD3G-CCR (aka Comcast Business Gateway) with firmware before 1.4.0.49.2 uses pred

23RISCO

abrir ↗

Referência

CVE-2014-1843

CVE-2014-1843—

Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attacke

38RISCO

abrir ↗

Referência✓ VexDay Proof

Morovia Barcode ActiveX Professional 3.3.1304 - Arbitrary File Overwrite

CVE-2007-2644—remotewindows

A certain ActiveX control in Morovia Barcode ActiveX Professional 3.3.1304 allows remote attackers to overwrite arbitrar

23RISCO

abrir ↗

Referência

CVE-2017-6999

CVE-2017-6999—

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO

23RISCO

abrir ↗

Referência

CVE-2017-6997

CVE-2017-6997—

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO

23RISCO

abrir ↗

Referência

CVE-2016-10045

CVE-2016-10045—

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman

60RISCO

abrir ↗

Referência

CVE-2020-14883

CVE-2020-14883HIGHsob ataque

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

100RISCO

abrir ↗

Referência

CVE-2014-0112

CVE-2014-0112—

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which all

60RISCO

abrir ↗

Referência

CVE-2019-11599

CVE-2019-11599—

The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma la

23RISCO

abrir ↗

Referência

CVE-2019-11599

CVE-2019-11599—

The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma la

23RISCO

abrir ↗

Referência

CVE-2023-38831

CVE-2023-38831HIGHsob ataqueransomware

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a

100RISCO

abrir ↗

Referência

CVE-2026-7740

CVE-2026-7740MEDIUM

justdan96 tsMuxer vvc.cpp setFPS denial of service

33RISCO

abrir ↗

Referência

CVE-2026-7739

CVE-2026-7739MEDIUM

justdan96 tsMuxer hevc.cpp setFPS denial of service

33RISCO

abrir ↗

Referência

CVE-2026-7738

CVE-2026-7738MEDIUM

puchunjie doc-tools-mcp MCP mcp-server.ts open_document path traversal

33RISCO

abrir ↗

Referência✓ VexDay Proof

BandSite CMS 1.1.4 - Download Backup / Cross-Site Scripting / Cross-Site Request Forgery

CVE-2008-7057—webappsphp

Cross-site scripting (XSS) vulnerability in merchandise.php in BandSite CMS 1.1.4 allows remote attackers to inject arbi

23RISCO

abrir ↗

Referência✓ VexDay Proof

BandSite CMS 1.1.4 - Download Backup / Cross-Site Scripting / Cross-Site Request Forgery

CVE-2008-7058—webappsphp

Cross-site request forgery (CSRF) vulnerability in BandSite CMS 1.1.4 allows remote attackers to hijack the authenticati

23RISCO

abrir ↗

Referência

WonderCMS 3.4.2 - Remote Code Execution (RCE)

CVE-2023-41425MEDIUMremotephp

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code

60RISCO

abrir ↗

Referência

CVE-2025-32433

CVE-2025-32433CRITICALsob ataque

Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

100RISCO

abrir ↗

Referência

CVE-2016-7621

CVE-2016-7621—

An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchO

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.