Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.533exploits catalogados

35.607CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.455Referência 22.407GitHub PoC 14.247VulnCheck XDB 8.663Nuclei 4.287Metasploit 3.474✓ só verificadosrecentes populares risco

22.407 exploits

Referência

CVE-2026-18682

CVE-2026-18682LOW

OpenAkita File Upload API upload cross site scripting

28RISCO

abrir ↗

Referência

CVE-2026-18648

CVE-2026-18648MEDIUM

Blix Email Blue Mail Calendar App react-native-receive-sharing-intent FileDirectory.getFileFromUri path traversal

33RISCO

abrir ↗

Referência

CVE-2026-18647

CVE-2026-18647MEDIUM

jina-ai reader Crawler/Puppeteer crawler.ts isValidTLD server-side request forgery

33RISCO

abrir ↗

Referência

CVE-2026-18616

CVE-2026-18616CRITICAL

GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection

48RISCO

abrir ↗

Referência

CVE-2026-18614

CVE-2026-18614CRITICAL

GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable_echo_server command injection

48RISCO

abrir ↗

Referência

CVE-2026-18613

CVE-2026-18613CRITICAL

GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injection

48RISCO

abrir ↗

Referência

CVE-2026-18612

CVE-2026-18612CRITICAL

GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injection

48RISCO

abrir ↗

Referência

CVE-2026-61523

CVE-2026-61523HIGH

WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor

41RISCO

abrir ↗

Referência

CVE-2026-18610

CVE-2026-18610MEDIUM

NewType WebEIP EIP_Com_FileList.aspx improper authentication

33RISCO

abrir ↗

Referência✓ VexDay Proof

WebStudio eCatalogue - Blind SQL Injection

CVE-2008-5294—webappsphp

SQL injection vulnerability in index.php in WebStudio eCatalogue allows remote attackers to execute arbitrary SQL comman

23RISCO

abrir ↗

Referência✓ VexDay Proof

PG Real Estate - Authentication Bypass

CVE-2008-5306—webappsphp

SQL injection vulnerability in admin/index.php in PG Real Estate Solution allows remote attackers to execute arbitrary S

23RISCO

abrir ↗

Referência✓ VexDay Proof

LoveCMS 1.6.2 Final (Simple Forum 3.1d) - Change Admin Password

CVE-2008-5308—webappsphp

The Simple Forum 3.1d module for LoveCMS 1.6.2 Final does not properly restrict access to administrator functions, which

23RISCO

abrir ↗

Referência✓ VexDay Proof

e107 < 0.7.13 - 'usersettings.php' Blind SQL Injection

CVE-2008-5320—webappsphp

SQL injection vulnerability in usersettings.php in e107 0.7.13 and earlier allows remote authenticated users to execute

23RISCO

abrir ↗

Referência

CVE-2018-6941

CVE-2018-6941—

A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remot

23RISCO

abrir ↗

Referência✓ VexDay Proof

XOOPS Module GesGaleri - SQL Injection

CVE-2008-5321—webappsphp

SQL injection vulnerability in index.php in GesGaleri, a module for XOOPS, allows remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência✓ VexDay Proof

Wysi Wiki Wyg 1.0 - Local File Inclusion / Cross-Site Scripting / PHPInfo

CVE-2008-5322—webappsphp

Wysi Wiki Wyg 1.0 allows remote attackers to obtain system information via an invalid categup parameter to index.php, wh

23RISCO

abrir ↗

Referência✓ VexDay Proof

Wysi Wiki Wyg 1.0 - Local File Inclusion / Cross-Site Scripting / PHPInfo

CVE-2008-5323—webappsphp

Cross-site scripting (XSS) vulnerability in index.php in Wysi Wiki Wyg 1.0 allows remote attackers to inject arbitrary w

23RISCO

abrir ↗

Referência✓ VexDay Proof

Nitrotech 0.0.3a - Remote File Inclusion / SQL Injection

CVE-2008-5334—webappsphp

PHP remote file inclusion vulnerability in includes/common.php in NitroTech 0.0.3a allows remote attackers to execute ar

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHP-Fusion 7.00.1 - 'messages.php' SQL Injection

CVE-2008-5335—webappsphp

SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magic_quotes_gpc is disabled, allows

23RISCO

abrir ↗

Referência✓ VexDay Proof

Active Photo Gallery 6.2 - Authentication Bypass

CVE-2008-5641—webappsphp

SQL injection vulnerability in account.asp in Active Photo Gallery 6.2 allows remote attackers to execute arbitrary SQL

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component com_books - 'book_id' SQL Injection

CVE-2008-5643—webappsphp

SQL injection vulnerability in the Books (com_books) component for Joomla! allows remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência✓ VexDay Proof

DELTAScripts PHP Shop 1.0 - Authentication Bypass

CVE-2008-5648—webappsphp

SQL injection vulnerability in admin/login.php in DeltaScripts PHP Shop 1.0 allows remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência✓ VexDay Proof

WinFTP Server 2.3.0 - 'PASV Mode' Remote Denial of Service

CVE-2008-5666—doswindows

WinFTP FTP Server 2.3.0, when passive (aka PASV) mode is used, allows remote authenticated users to cause a denial of se

43RISCO

abrir ↗

Referência

CVE-2026-17459

CVE-2026-17459MEDIUM

perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink

33RISCO

abrir ↗

Referência✓ VexDay Proof

SAWStudio 3.9i - '.prf' Local Buffer Overflow (PoC)

CVE-2008-5722—doswindows

Buffer overflow in SAWStudio 3.9i allows user-assisted remote attackers to cause a denial of service (application crash)

28RISCO

abrir ↗

Referência✓ VexDay Proof

PowerStrip 3.84 - 'pstrip.sys' Local Privilege Escalation

CVE-2008-5725—localwindows

The NT kernel-mode driver (aka pstrip.sys) 5.0.1.1 and earlier in EnTech Taiwan PowerStrip 3.84 and earlier allows local

23RISCO

abrir ↗

Referência✓ VexDay Proof

CMS NetCat 3.12 - 'password_recovery.php' Blind SQL Injection

CVE-2008-5727—webappsphp

SQL injection vulnerability in modules/auth/password_recovery.php in AIST NetCat 3.12 and earlier, when magic_quotes_gpc

23RISCO

abrir ↗

Referência✓ VexDay Proof

CMS NetCat 3.12 - Multiple Vulnerabilities

CVE-2008-5730—webappsphp

Multiple CRLF injection vulnerabilities in AIST NetCat 3.12 and earlier allow remote attackers to have an unknown impact

23RISCO

abrir ↗

Referência✓ VexDay Proof

PGP Desktop 9.0.6 - 'PGPwded.sys' Local Denial of Service

CVE-2008-5731—doswindows

The PGPwded device driver (aka PGPwded.sys) in PGP Corporation PGP Desktop 9.0.6 build 6060 and 9.9.0 build 397 allows l

23RISCO

abrir ↗

Referência✓ VexDay Proof

BLOG 1.55B - 'image_upload.php' Arbitrary File Upload

CVE-2008-5732—webappsphp

Unrestricted file upload vulnerability in lib/image_upload.php in KafooeyBlog 1.55b allows remote attackers to execute a

28RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.