Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.620exploits catalogados

35.647CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.455Referência 22.429GitHub PoC 14.270VulnCheck XDB 8.693Nuclei 4.299Metasploit 3.474✓ só verificadosrecentes populares risco

22.415 exploits

Referência

CVE-2026-63771

CVE-2026-63771MEDIUM

Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header

33RISCO

abrir ↗

Referência

CVE-2026-13402

CVE-2026-13402MEDIUM

Royal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template Disclosure

33RISCO

abrir ↗

Referência

CVE-2026-16015

CVE-2026-16015MEDIUM

poco-ai poco-claw executor_manager API tasks.py create_task missing authentication

33RISCO

abrir ↗

Referência

CVE-2026-12869

CVE-2026-12869MEDIUM

Header Footer Builder for Elementor < 1.2.1 - Contributor+ Stored XSS via Template Import

33RISCO

abrir ↗

Referência

CVE-2026-15907

CVE-2026-15907MEDIUM

H3C SecPath F1000-C8300 g=log_fw_nbc_mail_jsondata sql injection

33RISCO

abrir ↗

Referência

CVE-2026-11579

CVE-2026-11579MEDIUM

Kali Forms < 2.4.17 - Unauthenticated Media Upload

33RISCO

abrir ↗

Referência✓ VexDay Proof

XOOPS Module Amevents - SQL Injection

CVE-2008-5768—webappsphp

SQL injection vulnerability in print.php in the AM Events (aka Amevents) module 0.22 for XOOPS allows remote attackers t

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHP weather 2.2.2 - Local File Inclusion / Cross-Site Scripting

CVE-2008-5770—webappsphp

Cross-site scripting (XSS) vulnerability in config/make_config.php in PHP Weather 2.2.2 allows remote attackers to injec

23RISCO

abrir ↗

Referência

CVE-2018-7297

CVE-2018-7297—

Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers

35RISCO

abrir ↗

Referência

CVE-2018-7312

CVE-2018-7312—

SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter.

23RISCO

abrir ↗

Referência

CVE-2018-7313

CVE-2018-7313—

SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter.

28RISCO

abrir ↗

Referência

CVE-2018-7315

CVE-2018-7315—

SQL Injection exists in the Ek Rishta 2.9 component for Joomla! via the gender, age1, age2, religion, mothertounge, cast

23RISCO

abrir ↗

Referência

CVE-2018-7358

CVE-2018-7358MEDIUM

ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper cha

55RISCO

abrir ↗

Referência

CVE-2018-7448

CVE-2018-7448—

Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote

28RISCO

abrir ↗

Referência

CVE-2018-7448

CVE-2018-7448—

Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote

28RISCO

abrir ↗

Referência

CVE-2018-7477

CVE-2018-7477—

SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/

23RISCO

abrir ↗

Referência

CVE-2026-58467

CVE-2026-58467HIGH

Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php

41RISCO

abrir ↗

Referência

CVE-2026-59102

CVE-2026-59102LOW

Forgejo < 15.0.3 - Stored XSS via Actions Run Full Name Rendering

28RISCO

abrir ↗

Referência

CVE-2026-59100

CVE-2026-59100LOW

LobeChat 2.2.9 - Broken Object Level Authorization via Chat-Group Agent Operations

28RISCO

abrir ↗

Referência

CVE-2026-59099

CVE-2026-59099CRITICAL

Apereo CAS 7.3.0 < 8.0.0-RC6 - AES-GCM Nonce Reuse Information Disclosure

48RISCO

abrir ↗

Referência

CVE-2026-58579

CVE-2026-58579MEDIUM

RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name

33RISCO

abrir ↗

Referência

CVE-2026-58578

CVE-2026-58578HIGH

LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Import

41RISCO

abrir ↗

Referência

CVE-2024-58352

CVE-2024-58352HIGH

Landray OA Unauthenticated HQL Injection via wechatLoginHelper.do

41RISCO

abrir ↗

Referência

CVE-2024-58352

CVE-2024-58352HIGH

Landray OA Unauthenticated HQL Injection via wechatLoginHelper.do

41RISCO

abrir ↗

Referência

CVE-2026-14618

CVE-2026-14618MEDIUM

Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service

33RISCO

abrir ↗

Referência

CVE-2026-14617

CVE-2026-14617LOW

NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivity

28RISCO

abrir ↗

Referência

CVE-2026-14610

CVE-2026-14610MEDIUM

Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile heap-based overflow

33RISCO

abrir ↗

Referência

CVE-2026-14605

CVE-2026-14605HIGH

RT-Thread ls1c CAN ls1c_can.h recvmsg stack-based overflow

41RISCO

abrir ↗

Referência

CVE-2026-14604

CVE-2026-14604MEDIUM

Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free

33RISCO

abrir ↗

Referência

CVE-2026-34114

CVE-2026-34114CRITICAL

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate_text.php

48RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.