Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.298exploits catalogados

35.468CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.451Referência 22.301GitHub PoC 14.137VulnCheck XDB 8.646Nuclei 4.289Metasploit 3.474✓ só verificadosrecentes populares risco

22.266 exploits

Referência

CVE-2018-6892

CVE-2018-6892—

An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy

60RISCO

abrir ↗

Referência

CVE-2018-6892

CVE-2018-6892—

An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy

60RISCO

abrir ↗

Referência

CVE-2018-6892

CVE-2018-6892—

An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy

60RISCO

abrir ↗

Referência

CVE-2018-6892

CVE-2018-6892—

An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy

60RISCO

abrir ↗

Referência

CVE-2026-34108

CVE-2026-34108CRITICAL

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text.php

48RISCO

abrir ↗

Referência

CVE-2026-34107

CVE-2026-34107CRITICAL

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate.php

48RISCO

abrir ↗

Referência

CVE-2011-0512

CVE-2011-0512—

SQL injection vulnerability in team.php in the Teams Structure module 3.0 for PHP-Fusion allows remote attackers to exec

23RISCO

abrir ↗

Referência

CVE-2026-34106

CVE-2026-34106CRITICAL

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in subtitles.php

48RISCO

abrir ↗

Referência✓ VexDay Proof

zBlog 1.2 - SQL Injection

CVE-2007-6577—webappsphp

Multiple SQL injection vulnerabilities in index.php in zBlog 1.2 allow remote attackers to execute arbitrary SQL command

23RISCO

abrir ↗

Referência✓ VexDay Proof

Wallpaper Site 1.0.09 - 'category.php' SQL Injection

CVE-2007-6580—webappsphp

Multiple SQL injection vulnerabilities in Wallpaper Site 1.0.09 allow remote attackers to execute arbitrary SQL commands

23RISCO

abrir ↗

Referência✓ VexDay Proof

1024 CMS 1.3.1 - Local File Inclusion / SQL Injection

CVE-2007-6584—webappsphp

Multiple directory traversal vulnerabilities in 1024 CMS 1.3.1 allow remote attackers to include and execute arbitrary l

23RISCO

abrir ↗

Referência

CVE-2026-10293

CVE-2026-10293HIGH

UTT HiPER 1200GW formFireWall strcpy stack-based overflow

41RISCO

abrir ↗

Referência

CVE-2011-0517

CVE-2011-0517—

Stack-based buffer overflow in Sielco Sistemi Winlog Pro 2.07.00 and earlier, when Run TCP/IP server is enabled, allows

50RISCO

abrir ↗

Referência

CVE-2013-2586

CVE-2013-2586—

XAMPP 1.8.1 does not properly restrict access to xampp/lang.php, which allows remote attackers to modify xampp/lang.tmp

23RISCO

abrir ↗

Referência

CVE-2018-7756

CVE-2018-7756—

RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TCP

35RISCO

abrir ↗

Referência✓ VexDay Proof

WebPortal CMS 0.6-beta - Remote Password Change

CVE-2008-0142—webappsphp

Multiple SQL injection vulnerabilities in WebPortal CMS 0.6-beta allow remote attackers to execute arbitrary SQL command

23RISCO

abrir ↗

Referência

CVE-2018-7777

CVE-2018-7777—

The vulnerability is due to insufficient handling of update_file request parameter on update_module.php in Schneider Ele

35RISCO

abrir ↗

Referência✓ VexDay Proof

SmallNuke 2.0.4 - Pass Recovery SQL Injection

CVE-2008-0147—webappsphp

SQL injection vulnerability in index.php in SmallNuke 2.0.4 and earlier, when magic_quotes_gpc is disabled, allows remot

23RISCO

abrir ↗

Referência

CVE-2026-58450

CVE-2026-58450MEDIUM

Invoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameter

33RISCO

abrir ↗

Referência✓ VexDay Proof

TUTOS 1.3 - 'cmd.php' Remote Command Execution

CVE-2008-0149—webappsphp

TUTOS 1.3 allows remote attackers to read system information via a direct request to php/admin/phpinfo.php, which calls

23RISCO

abrir ↗

Referência

CVE-2018-7841

CVE-2018-7841CRITICALsob ataque

A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code

100RISCO

abrir ↗

Referência

CVE-2018-7921

CVE-2018-7921—

Huawei B315s-22 products with software of 21.318.01.00.26 have an information leak vulnerability. Unauthenticated adjace

28RISCO

abrir ↗

Referência

CVE-2018-8021

CVE-2018-8021—

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to pos

35RISCO

abrir ↗

Referência

CVE-2023-54347

CVE-2023-54347HIGH

OpenEMR 7.0.1 Authentication Brute Force Mitigation Bypass

41RISCO

abrir ↗

Referência

CVE-2013-3535

CVE-2013-3535—

Multiple cross-site scripting (XSS) vulnerabilities in CMSLogik 1.2.0 and 1.2.1 allow remote attackers to inject arbitra

23RISCO

abrir ↗

Referência

CVE-2011-0652

CVE-2011-0652—

lnsfw1.sys 6.0.2900.5512 in Look 'n' Stop Firewall 2.06p4 and 2.07 allows local users to cause a denial of service (cras

23RISCO

abrir ↗

Referência

CVE-2013-3629

CVE-2013-3629—

ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution

50RISCO

abrir ↗

Referência

CVE-2013-3632

CVE-2013-3632HIGH

The Cron service in rpc.php in OpenMediaVault allows remote authenticated users to execute cron jobs as arbitrary users

68RISCO

abrir ↗

Referência✓ VexDay Proof

LulieBlog 1.02 - SQL Injection

CVE-2008-0446—webappsphp

SQL injection vulnerability in voircom.php in LulieBlog 1.02 allows remote attackers to execute arbitrary SQL commands v

23RISCO

abrir ↗

Referência✓ VexDay Proof

Foojan Wms 1.0 - 'story' SQL Injection

CVE-2008-0447—webappsphp

SQL injection vulnerability in index.php in Foojan WMS PHP Weblog 1.0 allows remote attackers to execute arbitrary SQL c

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.