Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.401exploits catalogados

35.511CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.451Referência 22.332GitHub PoC 14.209VulnCheck XDB 8.646Nuclei 4.289Metasploit 3.474✓ só verificadosrecentes populares risco

22.301 exploits

Referência

CVE-2018-25430

CVE-2018-25430HIGH

Paroiciel 11.20 SQL Injection via eGeqIdEquipe Parameter

41RISCO

abrir ↗

Referência

CVE-2018-25429

CVE-2018-25429HIGH

Paroiciel 11.20 SQL Injection via zProIdPro Parameter

41RISCO

abrir ↗

Referência

CVE-2018-25428

CVE-2018-25428HIGH

Paroiciel 11.20 SQL Injection via tRecIdListe Parameter

41RISCO

abrir ↗

Referência

CVE-2026-10281

CVE-2026-10281MEDIUM

Enderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authentication

33RISCO

abrir ↗

Referência✓ VexDay Proof

Invision Power Board 2.1.4 - Register Users Denial of Service

CVE-2006-0888—dosmultiple

index.php in Invision Power Board (IPB) 2.0.1, with Code Confirmation disabled, allows remote attackers to cause an unsp

23RISCO

abrir ↗

Referência

CVE-2026-10280

CVE-2026-10280MEDIUM

horizon921 mcpilot MCP API Call Endpoint route.ts server-side request forgery

33RISCO

abrir ↗

Referência

CVE-2026-10279

CVE-2026-10279MEDIUM

hiraishikentaro wezterm-mcp switch_pane/write_to_specific_pane wezterm_executor.ts os command injection

33RISCO

abrir ↗

Referência

CVE-2026-10278

CVE-2026-10278MEDIUM

ishayoyo excel-mcp read_file/write_file index.ts path traversal

33RISCO

abrir ↗

Referência✓ VexDay Proof

Bandwebsite 1.5 - SQL Injection / Cross-Site Scripting

CVE-2008-5337—webappsphp

SQL injection vulnerability in lyrics.php in Bandwebsite (aka Bandsite portal system) 1.5 allows remote attackers to exe

23RISCO

abrir ↗

Referência

CVE-2026-10766

CVE-2026-10766LOW

mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hash

28RISCO

abrir ↗

Referência

CVE-2026-10237

CVE-2026-10237MEDIUM

SourceCodester Water Billing Management System User Management manage_user sql injection

33RISCO

abrir ↗

Referência

CVE-2019-1999

CVE-2019-1999—

In binder_alloc_free_page of binder_alloc.c, there is a possible double free due to improper locking. This could lead to

23RISCO

abrir ↗

Referência

CVE-2019-20215

CVE-2019-20215—

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the

60RISCO

abrir ↗

Referência

CVE-2026-7723

CVE-2026-7723MEDIUM

PrefectHQ prefect WebSocket Endpoint in missing authentication

33RISCO

abrir ↗

Referência

CVE-2026-7722

CVE-2026-7722MEDIUM

PrefectHQ prefect Health Check API health endswith improper authentication

33RISCO

abrir ↗

Referência

CVE-2026-7721

CVE-2026-7721MEDIUM

Totolink WA300 cstecgi.cgi NTPSyncWithHost command injection

33RISCO

abrir ↗

Referência

CVE-2026-7720

CVE-2026-7720MEDIUM

Totolink WA300 POST Request cstecgi.cgi setLanguageCfg command injection

33RISCO

abrir ↗

Referência

CVE-2026-7719

CVE-2026-7719CRITICAL

Totolink WA300 POST Request cstecgi.cgi loginauth buffer overflow

48RISCO

abrir ↗

Referência

CVE-2026-7715

CVE-2026-7715MEDIUM

ravenwits mcp-server-arangodb MCP tools.ts arango_backup path traversal

33RISCO

abrir ↗

Referência

CVE-2026-7600

CVE-2026-7600MEDIUM

ArtMin96 yii2-mcp-server MCP index.ts yii_execute_command os command injection

33RISCO

abrir ↗

Referência

CVE-2026-7599

CVE-2026-7599MEDIUM

Dayoooun hwpx-mcp MCP index.ts export_to_html path traversal

33RISCO

abrir ↗

Referência

CVE-2026-7597

CVE-2026-7597MEDIUM

mem0ai mem0 faiss.py pickle.dump deserialization

33RISCO

abrir ↗

Referência

CVE-2026-7596

CVE-2026-7596MEDIUM

nextlevelbuilder ui-ux-pro-max-skill Slide Generator generate-slide.py data.get cross site scripting

33RISCO

abrir ↗

Referência

CVE-2026-7595

CVE-2026-7595MEDIUM

nextlevelbuilder ui-ux-pro-max-skill Tailwind Config Generator tailwind_config_gen.py _format_plugins code injection

33RISCO

abrir ↗

Referência

CVE-2026-7594

CVE-2026-7594MEDIUM

Flux159 mcp-game-asset-gen MCP index.ts image_to_3d_async path traversal

33RISCO

abrir ↗

Referência

CVE-2026-7593

CVE-2026-7593MEDIUM

Sunwood-ai-labs command-executor-mcp-server MCP index.ts execute_command os command injection

33RISCO

abrir ↗

Referência

CVE-2026-7592

CVE-2026-7592MEDIUM

itsourcecode Courier Management System edit_staff.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-7591

CVE-2026-7591MEDIUM

TimBroddin astro-mcp-server MCP Tool Query Construction index.ts sql injection

33RISCO

abrir ↗

Referência

CVE-2026-7590

CVE-2026-7590MEDIUM

eyal-gor p_69_branch_monkey_mcp Preview Endpoint advanced.py os command injection

33RISCO

abrir ↗

Referência

CVE-2026-7588

CVE-2026-7588MEDIUM

ggerve coding-standards-mcp server.py get_best_practices path traversal

33RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.