Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.302exploits catalogados

35.469CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.451Referência 22.301GitHub PoC 14.141VulnCheck XDB 8.646Nuclei 4.289Metasploit 3.474✓ só verificadosrecentes populares risco

22.301 exploits

Referência

CVE-2018-18795

CVE-2018-18795—

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter.

23RISCO

abrir ↗

Referência

CVE-2018-18797

CVE-2018-18797—

School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.

23RISCO

abrir ↗

Referência

CVE-2018-18797

CVE-2018-18797—

School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.

23RISCO

abrir ↗

Referência

CVE-2018-18798

CVE-2018-18798—

Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.ph

23RISCO

abrir ↗

Referência

CVE-2018-18798

CVE-2018-18798—

Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.ph

23RISCO

abrir ↗

Referência✓ VexDay Proof

Seditio CMS 121 - 'pfs.php' Arbitrary File Upload

CVE-2007-4057—webappsphp

Unrestricted file upload vulnerability in pfs.php in Neocrome Seditio 121 and earlier allows remote authenticated users

23RISCO

abrir ↗

Referência

CVE-2018-19135

CVE-2018-19135—

ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default). This can be used by an

23RISCO

abrir ↗

Referência

CVE-2018-19371

CVE-2018-19371—

The SaveUserSettings service in Content Manager in SDL Web 8.5.0 has an XXE Vulnerability that allows reading sensitive

23RISCO

abrir ↗

Referência

CVE-2012-4279

CVE-2012-4279—

Multiple SQL injection vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to execute arbitrary SQL commands v

23RISCO

abrir ↗

Referência✓ VexDay Proof

VMware Inc 6.0.0 - CreateProcess Remote Code Execution

CVE-2007-4155—remotewindows

Absolute path traversal vulnerability in a certain ActiveX control in vielib.dll in EMC VMware 6.0.0 allows remote attac

23RISCO

abrir ↗

Referência

CVE-2012-4280

CVE-2012-4280—

Multiple cross-site request forgery (CSRF) vulnerabilities in admin/agenteditor.php in Free Realty 3.1-0.6 allow remote

23RISCO

abrir ↗

Referência✓ VexDay Proof

paBugs 2.0 Beta 3 - 'main.php?cid' SQL Injection

CVE-2007-4183—webappsphp

SQL injection vulnerability in main.php in paBugs 2.0 Beta 3 and earlier allows remote attackers to execute arbitrary SQ

23RISCO

abrir ↗

Referência

CVE-2018-19571

CVE-2018-19571—

GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an

28RISCO

abrir ↗

Referência

CVE-2018-19752

CVE-2018-19752—

DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.

38RISCO

abrir ↗

Referência✓ VexDay Proof

FrontAccounting 1.12 build 31 - Remote File Inclusion

CVE-2007-4279—webappsphp

PHP remote file inclusion vulnerability in config.php in FrontAccounting 1.12 Build 31 allows remote attackers to execut

45RISCO

abrir ↗

Referência

CVE-2018-19913

CVE-2018-19913—

DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.

23RISCO

abrir ↗

Referência

CVE-2018-20219

CVE-2018-20219—

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the de

28RISCO

abrir ↗

Referência

CVE-2018-20250

CVE-2018-20250HIGHsob ataqueransomware

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o

100RISCO

abrir ↗

Referência

CVE-2018-20250

CVE-2018-20250HIGHsob ataqueransomware

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o

100RISCO

abrir ↗

Referência

CVE-2018-20250

CVE-2018-20250HIGHsob ataqueransomware

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o

100RISCO

abrir ↗

Referência

CVE-2010-5285

CVE-2010-5285—

Cross-site request forgery (CSRF) vulnerability in admin.php in Collabtive 0.6.5 allows remote attackers to hijack the a

23RISCO

abrir ↗

Referência

CVE-2018-20469

CVE-2018-20469—

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A parameter in the web reports module is vulnerable to

28RISCO

abrir ↗

Referência

CVE-2018-20525

CVE-2018-20525—

Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.

28RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component Nice Talk 0.9.3 - 'tagid' SQL Injection

CVE-2007-4503—webappsphp

SQL injection vulnerability in index.php in the Nice Talk component (com_nicetalk) 0.9.3 and earlier for Joomla! allows

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component NeoRecruit 1.4 - 'id' SQL Injection

CVE-2007-4506—webappsphp

SQL injection vulnerability in index.php in the NeoRecruit component (com_neorecruit) 1.4 and earlier for Joomla! allows

23RISCO

abrir ↗

Referência

CVE-2026-2601

CVE-2026-2601MEDIUM

Missing Authorization in GitLab

33RISCO

abrir ↗

Referência

CVE-2026-4868

CVE-2026-4868HIGH

Authorization Bypass Through User-Controlled Key in GitLab

41RISCO

abrir ↗

Referência

CVE-2026-5296

CVE-2026-5296MEDIUM

Missing Authorization in GitLab

33RISCO

abrir ↗

Referência

CVE-2026-6713

CVE-2026-6713MEDIUM

Incorrect Authorization in GitLab

33RISCO

abrir ↗

Referência

CVE-2010-5285

CVE-2010-5285—

Cross-site request forgery (CSRF) vulnerability in admin.php in Collabtive 0.6.5 allows remote attackers to hijack the a

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.