Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.302exploits catalogados

35.469CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.451Referência 22.301GitHub PoC 14.141VulnCheck XDB 8.646Nuclei 4.289Metasploit 3.474✓ só verificadosrecentes populares risco

22.301 exploits

Referência

CVE-2026-60105

CVE-2026-60105HIGH

Monsta FTP < 2.14.5 SSRF via IPv4-Mapped IPv6 Address Bypass

41RISCO

abrir ↗

Referência

CVE-2026-10834

CVE-2026-10834MEDIUM

WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image

33RISCO

abrir ↗

Referência

CVE-2018-14728

CVE-2018-14728—

upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter.

60RISCO

abrir ↗

Referência

CVE-2026-5655

CVE-2026-5655MEDIUM

Use After Free in Wireshark

33RISCO

abrir ↗

Referência✓ VexDay Proof

Linksys SPA941 - Remote Reboot (Denial of Service)

CVE-2007-2270—doshardware

The Linksys SPA941 VoIP Phone allows remote attackers to cause a denial of service (device reboot) via a 0377 (0xff) cha

23RISCO

abrir ↗

Referência

CVE-2026-7686

CVE-2026-7686MEDIUM

eyeo Adblock Plus Legacy Premium Activation premium.preload.js postMessage access control

33RISCO

abrir ↗

Referência

CVE-2026-7685

CVE-2026-7685HIGH

Edimax BR-6208AC setWAN buffer overflow

41RISCO

abrir ↗

Referência

CVE-2026-7684

CVE-2026-7684HIGH

Edimax BR-6428nC setWAN buffer overflow

41RISCO

abrir ↗

Referência

CVE-2026-7681

CVE-2026-7681MEDIUM

jsbroks COCO Annotator Dataset API datasets.py authorization

33RISCO

abrir ↗

Referência

CVE-2026-7680

CVE-2026-7680MEDIUM

jsbroks COCO Annotator Data Endpoint datasets.py path traversal

33RISCO

abrir ↗

Referência✓ VexDay Proof

Microsoft Windows - GDI+ '.ICO' File Remote Denial of Service

CVE-2007-2237—doswindows

Microsoft Windows Graphics Device Interface (GDI+, GdiPlus.dll) allows context-dependent attackers to cause a denial of

28RISCO

abrir ↗

Referência

CVE-2026-10185

CVE-2026-10185MEDIUM

SourceCodester Hospitals Patient Records Management System Users.php save sql injection

33RISCO

abrir ↗

Referência

CVE-2026-10184

CVE-2026-10184MEDIUM

SourceCodester Hospitals Patient Records Management System Users.php delete sql injection

33RISCO

abrir ↗

Referência✓ VexDay Proof

USP FOSS Distribution 1.01 - 'dnld' Remote File Disclosure

CVE-2007-2271—webappsphp

Directory traversal vulnerability in Rajneel Lal TotaRam USP FOSS Distribution 1.01 allows remote attackers to read arbi

23RISCO

abrir ↗

Referência

CVE-2026-10169

CVE-2026-10169MEDIUM

OUSL-GROUP-BrinaryBrains School Student Management System Forgot Password Endpoint Login.php ajax_forgot_password password recovery

33RISCO

abrir ↗

Referência

CVE-2018-15437

CVE-2018-15437MEDIUM

Cisco Immunet and Cisco AMP for Endpoints System Scan Denial of Service Vulnerability

33RISCO

abrir ↗

Referência

CVE-2026-7398

CVE-2026-7398MEDIUM

florensiawidjaja BioinfoMCP Upload Endpoint app.py upload path traversal

33RISCO

abrir ↗

Referência

CVE-2026-7397

CVE-2026-7397MEDIUM

NousResearch hermes-agent file_tools.py _check_sensitive_path symlink

33RISCO

abrir ↗

Referência

CVE-2026-7396

CVE-2026-7396MEDIUM

NousResearch hermes-agent WeChat Work Platform Adapter wecom.py path traversal

33RISCO

abrir ↗

Referência

CVE-2026-7394

CVE-2026-7394MEDIUM

SourceCodester Pizzafy Ecommerce System GET Parameter view_order.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-7393

CVE-2026-7393MEDIUM

SourceCodester Pizzafy Ecommerce System File Extension admin_class_novo.php save_menu unrestricted upload

33RISCO

abrir ↗

Referência

CVE-2018-15442

CVE-2018-15442HIGH

Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability

61RISCO

abrir ↗

Referência

CVE-2026-7291

CVE-2026-7291MEDIUM

o2oa URL Fetching FileAction.java FileAction server-side request forgery

33RISCO

abrir ↗

Referência

CVE-2018-15657

CVE-2018-15657—

An SSRF issue was discovered in 42Gears SureMDM before 2018-11-27 via the /api/DownloadUrlResponse.ashx "url" parameter.

23RISCO

abrir ↗

Referência

CVE-2018-15687

CVE-2018-15687HIGH

systemd: chown_one() can dereference symlinks

41RISCO

abrir ↗

Referência

CVE-2018-15745

CVE-2018-15745—

Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F

60RISCO

abrir ↗

Referência

CVE-2018-15844

CVE-2018-15844—

An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's pas

23RISCO

abrir ↗

Referência

CVE-2018-15877

CVE-2018-15877—

The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell meta

60RISCO

abrir ↗

Referência

CVE-2010-5099

CVE-2010-5099—

The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.

23RISCO

abrir ↗

Referência

CVE-2018-15917

CVE-2018-15917—

Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HT

38RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.