Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.302exploits catalogados

35.469CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.451Referência 22.301GitHub PoC 14.141VulnCheck XDB 8.646Nuclei 4.289Metasploit 3.474✓ só verificadosrecentes populares risco

22.301 exploits

Referência

CVE-2026-5542

CVE-2026-5542MEDIUM

code-projects Simple Laundry System Parameter modstaffinfo.php cross site scripting

33RISCO

abrir ↗

Referência

CVE-2026-5541

CVE-2026-5541MEDIUM

code-projects Simple Laundry System Parameter modmemberinfo.php cross site scripting

33RISCO

abrir ↗

Referência

CVE-2026-5540

CVE-2026-5540MEDIUM

code-projects Simple Laundry System Parameter modifymember.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-5539

CVE-2026-5539MEDIUM

code-projects Simple Laundry System Parameter modifymember.php cross site scripting

33RISCO

abrir ↗

Referência

CVE-2026-5537

CVE-2026-5537MEDIUM

halex CourseSEL HTTP GET Parameter IndexController.class.php check_sel sql injection

33RISCO

abrir ↗

Referência

CVE-2026-5535

CVE-2026-5535MEDIUM

FedML-AI FedML MQTT Message FileUtils.java path traversal

33RISCO

abrir ↗

Referência

CVE-2026-5532

CVE-2026-5532MEDIUM

ScrapeGraphAI scrapegraph-ai GenerateCodeNode generate_code_node.py create_sandbox_and_execute os command injection

33RISCO

abrir ↗

Referência

CVE-2026-5531

CVE-2026-5531MEDIUM

SourceCodester Student Result Management System HTTP GET Request login_credentials.txt cleartext storage in file

33RISCO

abrir ↗

Referência

CVE-2026-5529

CVE-2026-5529MEDIUM

Dromara lamp-cloud DefUserController pageUser improper authorization

33RISCO

abrir ↗

Referência

CVE-2026-5528

CVE-2026-5528MEDIUM

MoussaabBadla code-screenshot-mcp HTTP os command injection

33RISCO

abrir ↗

Referência

CVE-2018-25246

CVE-2018-25246HIGH

Wikipedia 12.0 Denial of Service via Search

41RISCO

abrir ↗

Referência

CVE-2016-20054

CVE-2016-20054MEDIUM

Nodcms Cross Site Request Forgery via admin endpoints

33RISCO

abrir ↗

Referência

CVE-2018-25255

CVE-2018-25255HIGH

10-Strike LANState 8.8 Local Buffer Overflow SEH

41RISCO

abrir ↗

Referência

CVE-2018-25254

CVE-2018-25254CRITICAL

NICO-FTP 3.0.1.19 Buffer Overflow SEH

48RISCO

abrir ↗

Referência

CVE-2018-25253

CVE-2018-25253MEDIUM

Termite 3.4 Denial of Service via Settings Buffer Overflow

33RISCO

abrir ↗

Referência

CVE-2018-25252

CVE-2018-25252MEDIUM

FTP Voyager 16.2.0 Denial of Service via Malformed Site Profile

33RISCO

abrir ↗

Referência

CVE-2010-4272

CVE-2010-4272—

SQL injection vulnerability in the Pulse Infotech Sponsor Wall (com_sponsorwall) component 1.1 for Joomla! allows remote

23RISCO

abrir ↗

Referência

CVE-2010-4282

CVE-2010-4282—

Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute a

43RISCO

abrir ↗

Referência✓ VexDay Proof

Ktools Photostore 3.5.2 - Multiple SQL Injections

CVE-2008-6648—webappsphp

SQL injection vulnerability in crumbs.php in Ktools PhotoStore 3.4.3 and 3.5.2 allows remote attackers to execute arbitr

23RISCO

abrir ↗

Referência✓ VexDay Proof

miniBloggie 1.0 - 'del.php' Arbitrary Delete Post

CVE-2008-6650—webappsphp

del.php in miniBloggie 1.0 allows remote attackers to delete arbitrary posts via a direct request with a modified post_i

23RISCO

abrir ↗

Referência✓ VexDay Proof

OxYProject 0.85 - 'edithistory.php' Remote Code Execution

CVE-2008-6651—webappsphp

Static code injection vulnerability in edithistory.php in OxYProject OxYBox 0.85 allows remote attackers to inject arbit

23RISCO

abrir ↗

Referência

CVE-2016-20079

CVE-2016-20079MEDIUM

WordPress Dharma Booking 2.28.3 Local File Inclusion via proccess.php

33RISCO

abrir ↗

Referência

CVE-2010-4347

CVE-2010-4347—

The ACPI subsystem in the Linux kernel before 2.6.36.2 uses 0222 permissions for the debugfs custom_method file, which a

23RISCO

abrir ↗

Referência

CVE-2010-4356

CVE-2010-4356—

SQL injection vulnerability in news_default.asp in Site2Nite Big Truck Broker allows remote attackers to execute arbitra

23RISCO

abrir ↗

Referência

CVE-2010-4356

CVE-2010-4356—

SQL injection vulnerability in news_default.asp in Site2Nite Big Truck Broker allows remote attackers to execute arbitra

23RISCO

abrir ↗

Referência✓ VexDay Proof

phpAuction - 'profile.php' SQL Injection (1)

CVE-2008-6663—webappsphp

SQL injection vulnerability in profile.php in PHPAuctions.info PHPAuctions (aka PHPAuctionSystem) allows remote attacker

23RISCO

abrir ↗

Referência✓ VexDay Proof

nweb2fax 0.2.7 - Multiple Vulnerabilities

CVE-2008-6669—webappsphp

viewrq.php in nweb2fax 0.2.7 and earlier allows remote attackers to execute arbitrary code via shell metacharacters in t

23RISCO

abrir ↗

Referência

CVE-2026-7121

CVE-2026-7121CRITICAL

Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection

48RISCO

abrir ↗

Referência

CVE-2010-4357

CVE-2010-4357—

SQL injection vulnerability in comments.php in SiteEngine 7.1 allows remote attackers to execute arbitrary SQL commands

23RISCO

abrir ↗

Referência

CVE-2017-8482

CVE-2017-8482—

The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.