Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

76.647exploits catalogados

34.986CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.443Referência 21.899GitHub PoC 14.014VulnCheck XDB 8.571Nuclei 4.248Metasploit 3.472✓ só verificadosrecentes populares risco

21.899 exploits

Referência

CVE-2015-7252

CVE-2015-7252—

Cross-site scripting (XSS) vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_

23RISCO

abrir ↗

Referência

CVE-2012-6038

CVE-2012-6038—

admin/core/admin_func.php in razorCMS before 1.2.1 does not properly restrict access to certain administrator directorie

23RISCO

abrir ↗

Referência

aiohttp 3.9.1 - directory traversal PoC

CVE-2024-23334MEDIUMwebappspython

aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

70RISCO

abrir ↗

Referência

CVE-2010-1477

CVE-2010-1477—

SQL injection vulnerability in the SermonSpeaker (com_sermonspeaker) component before 3.2.1 for Joomla! allows remote at

23RISCO

abrir ↗

Referência✓ VexDay Proof

RunCMS 1.6 - Multiple Vulnerabilities

CVE-2007-6546—webappsphp

RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a m

23RISCO

abrir ↗

Referência✓ VexDay Proof

AlkalinePHP 0.77.35 - 'adduser.php' Arbitrary Add Admin

CVE-2008-2346—webappsphp

AlkalinePHP 0.77.35 and earlier allows remote attackers to bypass authentication and gain administrative access by creat

23RISCO

abrir ↗

Referência✓ VexDay Proof

Tlnews 2.2 - Insecure Cookie Handling

CVE-2008-4752—webappsphp

TlNews 2.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlNews_login c

23RISCO

abrir ↗

Referência✓ VexDay Proof

adaptweb 0.9.2 - Local File Inclusion / SQL Injection

CVE-2009-2151—webappsphp

Directory traversal vulnerability in index.php in AdaptWeb 0.9.2 allows remote attackers to read arbitrary files via a .

23RISCO

abrir ↗

Referência

CVE-2014-9099

CVE-2014-9099—

Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attacker

23RISCO

abrir ↗

Referência

CVE-2026-15751

CVE-2026-15751MEDIUM

mastergo-design mastergo-magic-mcp mcp__getComponentGenerator component-workflow.md execute path traversal

33RISCO

abrir ↗

Referência

CVE-2017-14843

CVE-2017-14843—

Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.

23RISCO

abrir ↗

Referência

CVE-2017-14842

CVE-2017-14842—

Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.

23RISCO

abrir ↗

Referência

CVE-2018-11715

CVE-2018-11715—

The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject.

23RISCO

abrir ↗

Referência✓ VexDay Proof

Project Based Calendaring System (PBCS) 0.7.1 - Multiple Vulnerabilities

CVE-2008-2215—webappsphp

Multiple directory traversal vulnerabilities in Project-Based Calendaring System (PBCS) 0.7.1-1 allow remote attackers t

23RISCO

abrir ↗

Referência

CVE-2023-26692

CVE-2023-26692MEDIUM

ZCBS Zijper Collectie Beheer Systeem (ZCBS), Zijper Publication Management System (ZPBS), and Zijper Image Bank Manageme

33RISCO

abrir ↗

Referência

CVE-2014-2088

CVE-2014-2088—

Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrar

23RISCO

abrir ↗

Referência

CVE-2014-3991

CVE-2014-3991—

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary

23RISCO

abrir ↗

Referência

CVE-2011-3645

CVE-2011-3645—

Newgen OmniDocs allows remote attackers to bypass intended access restrictions via (1) a modified FolderRights parameter

23RISCO

abrir ↗

Referência

CVE-2010-0799

CVE-2010-0799—

Directory traversal vulnerability in misc/tell_a_friend/tell.php in phpunity.newsmanager allows remote attackers to read

23RISCO

abrir ↗

Referência

CVE-2010-0799

CVE-2010-0799—

Directory traversal vulnerability in misc/tell_a_friend/tell.php in phpunity.newsmanager allows remote attackers to read

23RISCO

abrir ↗

Referência

CVE-2010-2677

CVE-2010-2677—

PHP remote file inclusion vulnerability in mw_plugin.php in Open Web Analytics (OWA) 1.2.3, when magic_quotes_gpc is dis

23RISCO

abrir ↗

Referência

CVE-2010-2677

CVE-2010-2677—

PHP remote file inclusion vulnerability in mw_plugin.php in Open Web Analytics (OWA) 1.2.3, when magic_quotes_gpc is dis

23RISCO

abrir ↗

Referência✓ VexDay Proof

V-Webmail 1.6.4 - 'pear_dir' Remote File Inclusion

CVE-2006-2666—webappsphp

PHP remote file inclusion vulnerability in includes/mailaccess/pop3.php in V-Webmail 1.5 through 1.6.4 allows remote att

23RISCO

abrir ↗

Referência✓ VexDay Proof

FreeLyrics 1.0 - Remote File Disclosure

CVE-2008-5861—webappsphp

Directory traversal vulnerability in source.php in FreeLyrics 1.0 allows remote attackers to read arbitrary files via di

23RISCO

abrir ↗

Referência✓ VexDay Proof

DoceboLms 2.0.5 - 'help.php' Remote File Inclusion

CVE-2006-2668—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 2.05 allow remote attackers to execute arbitrary PHP co

23RISCO

abrir ↗

Referência✓ VexDay Proof

Ocean12 Mailing List Manager Gold - File Disclosure / SQL Injection / Cross-Site Scripting

CVE-2008-5979—webappsphp

Cross-site scripting (XSS) vulnerability in default.asp in Ocean12 Mailing List Manager Gold allows remote attackers to

23RISCO

abrir ↗

Referência✓ VexDay Proof

Visagesoft eXPert PDF EditorX - 'VSPDFEditorX.ocx' Insecure Method

CVE-2008-6496—doswindows

Insecure method vulnerability in the VSPDFEditorX.VSPDFEdit ActiveX control in VSPDFEditorX.ocx 1.0.200.0 in VISAGESOFT

23RISCO

abrir ↗

Referência✓ VexDay Proof

mrcgiguy the ticket system 2.0 PHP - Multiple Vulnerabilities

CVE-2009-2080—webappsphp

admin.php in MRCGIGUY The Ticket System 2.0 does not properly restrict access, which allows remote attackers to (1) obta

23RISCO

abrir ↗

Referência✓ VexDay Proof

phpBB Module NoMoKeTos Rules 0.0.1 - Remote File Inclusion

CVE-2007-1106—webappsphp

PHP remote file inclusion vulnerability in includes/functions_nomoketos_rules.php in the NoMoKeTos Rules 0.0.1 module fo

23RISCO

abrir ↗

Referência

CVE-2017-15977

CVE-2017-15977—

Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter.

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.