Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

78.794exploits catalogados
36.057CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.459Referência 22.721GitHub PoC 14.946VulnCheck XDB 8.829Nuclei 4.350Metasploit 3.489✓ só verificadosrecentespopularesrisco
22.721 exploits
Referência
CVE-2026-7738
CVE-2026-7738MEDIUM
puchunjie doc-tools-mcp MCP mcp-server.ts open_document path traversal
33RISCO
abrir ↗
Referência
CVE-2011-5211
CVE-2011-5211—
Cross-site scripting (XSS) vulnerability in the poll module in Subrion CMS 2.0.4 allows remote attackers to inject arbit
23RISCO
abrir ↗
Referência✓ VexDay Proof
LaserNet CMS 1.5 - SQL Injection
CVE-2008-1913—webappsphp
SQL injection vulnerability in index.php in Lasernet CMS 1.5 and 1.11, when magic_quotes_gpc is disabled, allows remote
23RISCO
abrir ↗
Referência
CVE-2025-32433
CVE-2025-32433CRITICALsob ataque
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISCO
abrir ↗
Referência
CVE-2023-0777
CVE-2023-0777HIGH
Authentication Bypass by Primary Weakness in modoboa/modoboa
61RISCO
abrir ↗
Referência
CVE-2026-7732
CVE-2026-7732MEDIUM
code-projects BloodBank Managing System request_blood.php unrestricted upload
33RISCO
abrir ↗
Referência
CVE-2026-19897
CVE-2026-19897MEDIUM
mangroup dtale Login Endpoint auth.py login excessive authentication
33RISCO
abrir ↗
Referência
CVE-2026-19896
CVE-2026-19896MEDIUM
mangroup dtale Flask Session Cookie app.py build_secret_key random values
33RISCO
abrir ↗
Referência
CVE-2026-19895
CVE-2026-19895MEDIUM
opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication
33RISCO
abrir ↗
Referência✓ VexDay Proof
BlogWorx 1.0 - 'id' SQL Injection
CVE-2008-1915—webappsphp
SQL injection vulnerability in view.asp in DevWorx BlogWorx 1.0 allows remote attackers to execute arbitrary SQL command
23RISCO
abrir ↗
Referência✓ VexDay Proof
5th Avenue Shopping Cart - 'category_id' SQL Injection
CVE-2008-1921—webappsphp
SQL injection vulnerability in store_pages/category_list.php in 5th Avenue Shopping Cart 1.2 trial edition allows remote
23RISCO
abrir ↗
Referência✓ VexDay Proof
Zune Software - ActiveX Arbitrary File Overwrite
CVE-2008-1933—remotewindows
Absolute path traversal vulnerability in a certain ActiveX control in Zune allows user-assisted remote attackers to over
28RISCO
abrir ↗
Referência
CVE-2026-16007
CVE-2026-16007HIGH
Authenticated SQL Injection in AppFlowy
41RISCO
abrir ↗
Referência
CVE-2025-61884
CVE-2025-61884HIGHsob ataqueransomware
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions
100RISCO
abrir ↗
Referência
CVE-2026-18216
CVE-2026-18216MEDIUM
Backup Migration < 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-Login
33RISCO
abrir ↗
Referência
CVE-2026-16611
CVE-2026-16611HIGH
Product Feed PRO for WooCommerce < 13.5.7 - Unauthenticated Feed Configuration Disclosure
41RISCO
abrir ↗
Referência
CVE-2026-16541
CVE-2026-16541MEDIUM
Simply Schedule Appointments < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST Endpoints
33RISCO
abrir ↗
Referência
CVE-2019-18818
CVE-2019-18818—
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s
60RISCO
abrir ↗
Referência✓ VexDay Proof
Crazy Goomba 1.2.1 - 'id' SQL Injection
CVE-2008-1934—webappsphp
SQL injection vulnerability in commentaires.php in Crazy Goomba 1.2.1 allows remote attackers to execute arbitrary SQL c
23RISCO
abrir ↗
Referência
CVE-2021-40382
CVE-2021-40382—
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. mjpegStreamer.cgi allo
28RISCO
abrir ↗
Referência✓ VexDay Proof
Classifieds Caffe - 'cat_id' SQL Injection
CVE-2008-1936—webappsphp
SQL injection vulnerability in index.php in Classifieds Caffe allows remote attackers to execute arbitrary SQL commands
23RISCO
abrir ↗
Referência✓ VexDay Proof
Web Calendar 4.1 - Blind SQL Injection
CVE-2008-1954—webappsphp
SQL injection vulnerability in one_day.php in Web Calendar Pro 4.1 and earlier allows remote attackers to execute arbitr
23RISCO
abrir ↗
Referência✓ VexDay Proof
TR News 2.1 - 'nb' SQL Injection
CVE-2008-1957—webappsphp
SQL injection vulnerability in news.php in Tr Script News 2.1 allows remote attackers to execute arbitrary SQL commands
23RISCO
abrir ↗
Referência
CVE-2023-0904
CVE-2023-0904MEDIUM
SourceCodester Employee Task Management System task-details.php sql injection
33RISCO
abrir ↗
Referência
CVE-2021-3378
CVE-2021-3378—
FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUpl
60RISCO
abrir ↗
Referência
CVE-2026-19834
CVE-2026-19834MEDIUM
Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization
33RISCO
abrir ↗
Referência★ 47
Unauthenticated RCE on CraftCMS when PHP `register_argc_argv` config setting is enabled
CVE-2024-56145CRITICALsob ataque
RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms
100RISCO
abrir ↗
Referência
CVE-2026-19829
CVE-2026-19829MEDIUM
648540858 wvp-GB28181-pro Log File Download Endpoint LogController.java path traversal
33RISCO
abrir ↗
Referência
CVE-2026-19828
CVE-2026-19828MEDIUM
648540858 wvp-GB28181-pro Snapshot Endpoint PlayController.java path traversal
33RISCO
abrir ↗
Referência
CVE-2026-19827
CVE-2026-19827MEDIUM
alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputStream path traversal
33RISCO
abrir ↗
← anteriorpágina 3 / 758próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.