Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.302exploits catalogados

35.469CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.451Referência 22.301GitHub PoC 14.141VulnCheck XDB 8.646Nuclei 4.289Metasploit 3.474✓ só verificadosrecentes populares risco

22.301 exploits

Referência

CVE-2018-25388

CVE-2018-25388HIGH

HaPe PKH 1.1 Arbitrary File Upload via aksi_foto.php

41RISCO

abrir ↗

Referência

CVE-2018-25387

CVE-2018-25387MEDIUM

HaPe PKH 1.1 Cross-Site Request Forgery via aksi_user.php

33RISCO

abrir ↗

Referência

CVE-2018-25386

CVE-2018-25386HIGH

HaPe PKH 1.1 SQL Injection via id Parameter in admin/media.php

41RISCO

abrir ↗

Referência

CVE-2018-25385

CVE-2018-25385HIGH

E-Registrasi Pencak Silat 18.10 SQL Injection via id_partai

41RISCO

abrir ↗

Referência

CVE-2018-25384

CVE-2018-25384MEDIUM

Wikidforum 2.20 Cross-Site Scripting via reply_text Parameter

33RISCO

abrir ↗

Referência

CVE-2011-4340

CVE-2011-4340—

Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow

23RISCO

abrir ↗

Referência✓ VexDay Proof

Limbo CMS - Private Messaging Component SQL Injection

CVE-2008-6078—webappsphp

SQL injection vulnerability in open.php in the Private Messaging (com_privmsg) component for Limbo CMS allows remote att

23RISCO

abrir ↗

Referência✓ VexDay Proof

Simple Customer 1.2 - 'contact.php' SQL Injection

CVE-2008-6081—webappsphp

SQL injection vulnerability in contact.php in Simple Customer 1.2 allows remote attackers to execute arbitrary SQL comma

23RISCO

abrir ↗

Referência

CVE-2026-15696

CVE-2026-15696HIGH

Tenda BE12 Pro VirtualSer fromVirtualSer stack-based overflow

41RISCO

abrir ↗

Referência

CVE-2026-58479

CVE-2026-58479CRITICAL

Sustainable Irrigation Platform 5.2.16 RCE via cli_control Plugin Command Injection

48RISCO

abrir ↗

Referência

Security research on Craft CMS authentication mechanism

CVE-2026-31266HIGH

Craft CMS 5.9.5 and earlier contains a Missing Authorization vulnerability in the migrate endpoint (/actions/app/migrate

41RISCO

abrir ↗

Referência

CVE-2026-13543

CVE-2026-13543MEDIUM

Documenso Google OAuth Login handle-oauth-callback-url.ts improper authentication

33RISCO

abrir ↗

Referência

CVE-2016-20069

CVE-2016-20069HIGH

WordPress Booking Calendar Contact Form 1.0.23 SQL Injection

41RISCO

abrir ↗

Referência

CVE-2014-8493

CVE-2014-8493—

ZTE ZXHN H108L with firmware 4.0.0d_ZRQ_GR4 allows remote attackers to modify the CWMP configuration via a crafted reque

23RISCO

abrir ↗

Referência

CVE-2026-15695

CVE-2026-15695HIGH

Tenda BE12 Pro DhcpListClient fromDhcpListClient stack-based overflow

41RISCO

abrir ↗

Referência

CVE-2026-58476

CVE-2026-58476HIGH

Sustainable Irrigation Platform 5.2.16 CSRF via Administrative GET Requests

41RISCO

abrir ↗

Referência

CVE-2026-15694

CVE-2026-15694HIGH

Tenda BE12 Pro SetIpBind fromSetIpBind stack-based overflow

41RISCO

abrir ↗

Referência

CVE-2026-10064

CVE-2026-10064MEDIUM

TRENDnet TEW-432BRP formSetPortTr stack-based overflow

33RISCO

abrir ↗

Referência

CVE-2018-25366

CVE-2018-25366HIGH

CuteFTP 5.0 XP Buffer Overflow via Site Manager Label Field

41RISCO

abrir ↗

Referência

CVE-2018-25365

CVE-2018-25365HIGH

PCViewer vt1000 Directory Traversal via GET Request

41RISCO

abrir ↗

Referência✓ VexDay Proof

Aztek Forum 4.00 - Cross-Site Scripting / SQL Injection

CVE-2006-1111—webappsphp

Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a "*/*" in the msg parameter to index.php, w

23RISCO

abrir ↗

Referência✓ VexDay Proof

Aztek Forum 4.00 - Cross-Site Scripting / SQL Injection

CVE-2006-1112—webappsphp

Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a long login value in a register form, which

23RISCO

abrir ↗

Referência

CVE-2021-47935

CVE-2021-47935HIGH

Sentry 8.2.0 Remote Code Execution via Pickle Deserialization

41RISCO

abrir ↗

Referência

CVE-2026-29004

CVE-2026-29004HIGH

BusyBox DHCPv6 Client Heap Buffer Overflow via DNS_SERVERS

41RISCO

abrir ↗

Referência

CVE-2026-7718

CVE-2026-7718MEDIUM

Totolink WA300 POST Request cstecgi.cgi setWebWlanIdx command injection

33RISCO

abrir ↗

Referência

CVE-2026-7717

CVE-2026-7717HIGH

Totolink WA300 POST Request cstecgi.cgi UploadCustomModule buffer overflow

41RISCO

abrir ↗

Referência

CVE-2026-7024

CVE-2026-7024MEDIUM

rawchen sims deleteFileServlet Endpoint DeleteFileServlet.java path traversal

33RISCO

abrir ↗

Referência

CVE-2026-6602

CVE-2026-6602MEDIUM

rickxy Hospital Management System his_admin_account.php unrestricted upload

33RISCO

abrir ↗

Referência

CVE-2026-9583

CVE-2026-9583MEDIUM

SourceCodester CET Automated Grading System with AI Predictive Analytics SQL index.php information exposure

33RISCO

abrir ↗

Referência

CVE-2026-59258

CVE-2026-59258HIGH

immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser

41RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.