Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

76.496exploits catalogados

34.964CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.443Referência 21.899GitHub PoC 13.937VulnCheck XDB 8.510Nuclei 4.239Metasploit 3.468✓ só verificadosrecentes populares risco

21.899 exploits

Referência

CVE-2026-15539

CVE-2026-15539MEDIUM

SourceCodester Online Book Store System Book Image Upload Feature index.php books unrestricted upload

33RISCO

abrir ↗

Referência

CVE-2026-12582

CVE-2026-12582HIGH

Library Management System < 3.5.8 - Unauthenticated SQL Injection via book_id

41RISCO

abrir ↗

Referência

CVE-2026-12397

CVE-2026-12397MEDIUM

WP Job Portal < 2.5.5 - Subscriber+ Employer Email Disclosure via IDOR

33RISCO

abrir ↗

Referência

CVE-2026-12396

CVE-2026-12396MEDIUM

WP Job Portal < 2.5.5 - Subscriber+ Arbitrary Job Approval, Featuring and Rejection

33RISCO

abrir ↗

Referência

CVE-2026-12275

CVE-2026-12275HIGH

Tutor LMS < 3.9.13 - Subscriber+ Unauthorized Course Enrollment and Private Course Content Disclosure via Droip/Kirki Integration

41RISCO

abrir ↗

Referência

CVE-2026-12274

CVE-2026-12274MEDIUM

Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR

33RISCO

abrir ↗

Referência

CVE-2026-12273

CVE-2026-12273MEDIUM

Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Auto-Approved Comment Creation

33RISCO

abrir ↗

Referência

CVE-2026-12271

CVE-2026-12271MEDIUM

Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDOR

33RISCO

abrir ↗

Referência✓ VexDay Proof

AvailScript Article Script - 'view.php' SQL Injection

CVE-2008-6037—webappsphp

SQL injection vulnerability in view.php in AvailScript Article Script allows remote attackers to execute arbitrary SQL c

23RISCO

abrir ↗

Referência✓ VexDay Proof

Netartmedia Real Estate Portal 1.2 - SQL Injection

CVE-2008-6042—webappsphp

SQL injection vulnerability in the re_search module in NetArtMedia Real Estate Portal 2.0 allows remote attackers to exe

23RISCO

abrir ↗

Referência

CVE-2026-6816

CVE-2026-6816MEDIUM

TFA Basic Plugins - Access Bypass

33RISCO

abrir ↗

Referência✓ VexDay Proof

Vlog System 1.1 - SQL Injection

CVE-2008-6111—webappsphp

SQL injection vulnerability in blog.php in NetArt Media Vlog System 1.1 allows remote attackers to execute arbitrary SQL

23RISCO

abrir ↗

Referência

CVE-2011-4342

CVE-2011-4342—

PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows re

28RISCO

abrir ↗

Referência

CVE-2011-4342

CVE-2011-4342—

PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows re

28RISCO

abrir ↗

Referência✓ VexDay Proof

e107 Plugin ZoGo-Shop 1.15.4 - 'product' SQL Injection

CVE-2008-6114—webappsphp

SQL injection vulnerability in product_details.php in the Mytipper Zogo-shop 1.15.4 plugin for e107 allows remote attack

23RISCO

abrir ↗

Referência✓ VexDay Proof

Prozilla Hosting Index - 'id' SQL Injection

CVE-2008-6115—webappsphp

SQL injection vulnerability in directory.php in Prozilla Hosting Index allows remote attackers to execute arbitrary SQL

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component Thyme 1.0 - SQL Injection

CVE-2008-6116—webappsphp

SQL injection vulnerability in the EXtrovert Software Thyme (com_thyme) 1.0 component for Joomla! allows remote attacker

23RISCO

abrir ↗

Referência✓ VexDay Proof

Full PHP Emlak Script - 'arsaprint.php' SQL Injection

CVE-2008-6133—webappsphp

SQL injection vulnerability in arsaprint.php in Full PHP Emlak Script allows remote attackers to execute arbitrary SQL c

23RISCO

abrir ↗

Referência

CVE-2026-15531

CVE-2026-15531MEDIUM

yashbhalgat HashNeRF-pytorch Checkpoint File run_nerf.py torch.load deserialization

33RISCO

abrir ↗

Referência

CVE-2026-15530

CVE-2026-15530MEDIUM

WuzhiCMS Attachment API index.php listimage information disclosure

33RISCO

abrir ↗

Referência

CVE-2026-15528

CVE-2026-15528MEDIUM

lamaalrajih kicad-mcp path_validator.py protection mechanism

33RISCO

abrir ↗

Referência

CVE-2026-15527

CVE-2026-15527MEDIUM

better-auth better-icons scan_project_icons/sync_icon path traversal

33RISCO

abrir ↗

Referência

CVE-2026-15526

CVE-2026-15526MEDIUM

augmnt augments-mcp-server scan_project_deps scan-project-deps.ts scanProjectDeps path traversal

33RISCO

abrir ↗

Referência

CVE-2026-15514

CVE-2026-15514MEDIUM

Metasoft 美特软件 MetaCRM PHPRPC Remote Call rpc.jsp RPCService.query sql injection

33RISCO

abrir ↗

Referência

CVE-2026-15513

CVE-2026-15513MEDIUM

Wavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injection

33RISCO

abrir ↗

Referência

CVE-2026-15512

CVE-2026-15512MEDIUM

pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection

33RISCO

abrir ↗

Referência

CVE-2026-15510

CVE-2026-15510MEDIUM

Leantime API saveSetting improper authorization

33RISCO

abrir ↗

Referência✓ VexDay Proof

Flexphpic 0.0.x - Authentication Bypass

CVE-2008-6142—webappsphp

Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPic 0.0.4 and FlexPHPic Pro 0.0.3, and other 0.0.

23RISCO

abrir ↗

Referência✓ VexDay Proof

OwenPoll 1.0 - Insecure Cookie Handling

CVE-2008-6143—webappsphp

OwenPoll 1.0 allows remote attackers to bypass authentication and obtain administrative access via a modified account na

23RISCO

abrir ↗

Referência✓ VexDay Proof

DeluxeBB 1.2 - Blind SQL Injection

CVE-2008-6146—webappsphp

SQL injection vulnerability in pm.php in DeluxeBB 1.2 and earlier, when magic_quotes_gpc is disabled, allows remote atta

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.