Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.620exploits catalogados

35.647CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.455Referência 22.429GitHub PoC 14.270VulnCheck XDB 8.693Nuclei 4.299Metasploit 3.474✓ só verificadosrecentes populares risco

22.429 exploits

Referência

CVE-2026-12497

CVE-2026-12497HIGH

ProfilePress < 4.16.18 - Unauthenticated Privilege Escalation via Registration Role Selection

41RISCO

abrir ↗

Referência

CVE-2026-16119

CVE-2026-16119MEDIUM

nextlevelbuilder GoClaw WebSocket Approval Endpoint exec_approval.go RequestApproval authorization

33RISCO

abrir ↗

Referência

CVE-2026-16088

CVE-2026-16088MEDIUM

halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal

33RISCO

abrir ↗

Referência

CVE-2026-16085

CVE-2026-16085MEDIUM

Sipeed PicoClaw context.go NewContextBuilder inclusion of functionality from untrusted control sphere

33RISCO

abrir ↗

Referência

CVE-2026-16084

CVE-2026-16084MEDIUM

Sipeed PicoClaw web.go web_fetch server-side request forgery

33RISCO

abrir ↗

Referência

CVE-2020-0618

CVE-2020-0618CRITICALsob ataqueransomware

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page

100RISCO

abrir ↗

Referência

CVE-2026-9694

CVE-2026-9694LOW

Improper Neutralization of Substitution Characters in GitLab

28RISCO

abrir ↗

Referência

CVE-2026-10087

CVE-2026-10087HIGH

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

41RISCO

abrir ↗

Referência

CVE-2026-11476

CVE-2026-11476MEDIUM

Kushan2k student-management-system Profile Update Endpoint AdminController.php edit-admin improper authorization

33RISCO

abrir ↗

Referência

CVE-2026-11475

CVE-2026-11475MEDIUM

Kushan2k student-management-system Certificate Verification Endpoint GradeController.php getStatus sql injection

33RISCO

abrir ↗

Referência

CVE-2026-11474

CVE-2026-11474MEDIUM

Kushan2k student-management-system Registration Endpoint RegisterService.php unrestricted upload

33RISCO

abrir ↗

Referência

CVE-2026-11472

CVE-2026-11472MEDIUM

SourceCodester Class and Exam Timetabling System index1.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-11471

CVE-2026-11471MEDIUM

SourceCodester Class and Exam Timetabling System index2.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-11470

CVE-2026-11470MEDIUM

hs-web hsweb-framework File Upload FileUploadProperties.java denied path traversal

33RISCO

abrir ↗

Referência

CVE-2026-11469

CVE-2026-11469MEDIUM

jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery

33RISCO

abrir ↗

Referência

CVE-2026-11468

CVE-2026-11468MEDIUM

SourceCodester Hospitals Patient Records Management System page room_types cross site scripting

33RISCO

abrir ↗

Referência

CVE-2025-71318

CVE-2025-71318CRITICAL

NetMan 204 Missing Authentication for Administrative Functions

48RISCO

abrir ↗

Referência

CVE-2025-71317

CVE-2025-71317CRITICAL

NetMan 204 Hard-coded Backdoor Credentials

48RISCO

abrir ↗

Referência

CVE-2026-11344

CVE-2026-11344MEDIUM

code-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted upload

33RISCO

abrir ↗

Referência

CVE-2026-11342

CVE-2026-11342MEDIUM

code-projects Hotel and Tourism Reservation System details.php sql injection

33RISCO

abrir ↗

Referência

CVE-2022-45899

CVE-2022-45899MEDIUM

Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as

33RISCO

abrir ↗

Referência

CVE-2024-33724

CVE-2024-33724MEDIUM

SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.

48RISCO

abrir ↗

Referência

CVE-2026-7709

CVE-2026-7709MEDIUM

janeczku Calibre-Web Endpoint kobo_auth.py generate_auth_token improper authorization

33RISCO

abrir ↗

Referência

CVE-2026-7708

CVE-2026-7708MEDIUM

Open5GS UDR subscription.c ogs_dbi_subscription_data denial of service

33RISCO

abrir ↗

Referência

CVE-2026-7700

CVE-2026-7700MEDIUM

langflow-ai langflow LambdaFilterComponent lambda_filter.p eval code injection

33RISCO

abrir ↗

Referência

CVE-2026-7698

CVE-2026-7698MEDIUM

Tiandy Easy7 Integrated Management Platform updateDbBackupInfo os command injection

33RISCO

abrir ↗

Referência

CVE-2026-7697

CVE-2026-7697MEDIUM

AMTT Hotel Broadband Operation System cardhand_submit.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-7696

CVE-2026-7696MEDIUM

Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform uploadH5Files unrestricted upload

33RISCO

abrir ↗

Referência

CVE-2026-7695

CVE-2026-7695MEDIUM

Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform elecMaxMinAvgValue sql injection

33RISCO

abrir ↗

Referência

CVE-2026-14919

CVE-2026-14919CRITICAL

ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset Email Reroute

48RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.