Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.620exploits catalogados

35.647CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.455Referência 22.429GitHub PoC 14.270VulnCheck XDB 8.693Nuclei 4.299Metasploit 3.474✓ só verificadosrecentes populares risco

22.429 exploits

Referência

CVE-2026-19896

CVE-2026-19896MEDIUM

mangroup dtale Flask Session Cookie app.py build_secret_key random values

33RISCO

abrir ↗

Referência

CVE-2026-19895

CVE-2026-19895MEDIUM

opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication

33RISCO

abrir ↗

Referência

CVE-2023-0777

CVE-2023-0777HIGH

Authentication Bypass by Primary Weakness in modoboa/modoboa

61RISCO

abrir ↗

Referência✓ VexDay Proof

KTP Computer Customer Database CMS 1.0 - Blind SQL Injection

CVE-2008-5952—webappsphp

SQL injection vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows re

23RISCO

abrir ↗

Referência

CVE-2025-32433

CVE-2025-32433CRITICALsob ataque

Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

100RISCO

abrir ↗

Referência

CVE-2026-7732

CVE-2026-7732MEDIUM

code-projects BloodBank Managing System request_blood.php unrestricted upload

33RISCO

abrir ↗

Referência✓ VexDay Proof

Active Test 2.1 - 'QuizID' Blind SQL Injection

CVE-2008-5958—webappsasp

Multiple SQL injection vulnerabilities in Active Test 2.1 allow remote attackers to execute arbitrary SQL commands via t

23RISCO

abrir ↗

Referência

CVE-2026-19834

CVE-2026-19834MEDIUM

Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization

33RISCO

abrir ↗

Referência

CVE-2026-19829

CVE-2026-19829MEDIUM

648540858 wvp-GB28181-pro Log File Download Endpoint LogController.java path traversal

33RISCO

abrir ↗

Referência

CVE-2021-3378

CVE-2021-3378—

FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUpl

60RISCO

abrir ↗

Referência

CVE-2021-3378

CVE-2021-3378—

FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUpl

60RISCO

abrir ↗

Referência✓ VexDay Proof

PHP iCalendar 2.24 - 'cookie_language' Local File Inclusion / Arbitrary File Upload

CVE-2008-5968—webappsphp

Directory traversal vulnerability in print.php in PHP iCalendar 2.24 and earlier allows remote attackers to include and

23RISCO

abrir ↗

Referência

CVE-2026-19828

CVE-2026-19828MEDIUM

648540858 wvp-GB28181-pro Snapshot Endpoint PlayController.java path traversal

33RISCO

abrir ↗

Referência

CVE-2026-19827

CVE-2026-19827MEDIUM

alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputStream path traversal

33RISCO

abrir ↗

Referência

CVE-2026-19826

CVE-2026-19826MEDIUM

alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserialization

33RISCO

abrir ↗

Referência

CVE-2023-0904

CVE-2023-0904MEDIUM

SourceCodester Employee Task Management System task-details.php sql injection

33RISCO

abrir ↗

Referência✓ VexDay Proof

SunByte e-Flower - 'id' SQL Injection

CVE-2008-5969—webappsphp

SQL injection vulnerability in popupproduct.php in Sunbyte e-Flower allows remote attackers to execute arbitrary SQL com

23RISCO

abrir ↗

Referência

CVE-2008-5970

CVE-2008-5970—

SQL injection vulnerability in profile_social.php in i-Net Solution Orkut Clone allows remote authenticated users to exe

23RISCO

abrir ↗

Referência★ 47

Unauthenticated RCE on CraftCMS when PHP `register_argc_argv` config setting is enabled

CVE-2024-56145CRITICALsob ataque

RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

100RISCO

abrir ↗

Referência

CVE-2016-7288

CVE-2016-7288—

The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m

45RISCO

abrir ↗

Referência

CVE-2026-19825

CVE-2026-19825MEDIUM

SourceCodester Simple Client Management System Master.php save_service sql injection

33RISCO

abrir ↗

Referência

CVE-2026-19824

CVE-2026-19824HIGH

Tenda W20E addIpMacBind ipMacBindListStore stack-based overflow

41RISCO

abrir ↗

Referência✓ VexDay Proof

Active Business Directory 2 - Blind SQL Injection

CVE-2008-5972—webappsphp

SQL injection vulnerability in default.asp in Active Business Directory 2 allows remote attackers to execute arbitrary S

23RISCO

abrir ↗

Referência✓ VexDay Proof

Active Web Mail 4 - Authentication Bypass

CVE-2008-5973—webappsasp

SQL injection vulnerability in login.aspx in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL comman

23RISCO

abrir ↗

Referência✓ VexDay Proof

Ocean12 Mailing List Manager Gold - File Disclosure / SQL Injection / Cross-Site Scripting

CVE-2008-5978—webappsphp

Multiple SQL injection vulnerabilities in Ocean12 Mailing List Manager Gold allow remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência

CVE-2023-0912

CVE-2023-0912MEDIUM

SourceCodester Auto Dealer Management System sql injection

33RISCO

abrir ↗

Referência✓ VexDay Proof

Jetik Emlak ESA 2.0 - Multiple SQL Injections

CVE-2008-5992—webappsphp

Multiple SQL injection vulnerabilities in Jetik Emlak Sistem A (ESA) 2.0 allow remote attackers to execute arbitrary SQL

23RISCO

abrir ↗

Referência✓ VexDay Proof

I-Rater Basic - SQL Injection

CVE-2008-6017—webappsphp

SQL injection vulnerability in messages.php in I-Rater Basic allows remote attackers to execute arbitrary SQL commands v

23RISCO

abrir ↗

Referência

CVE-2019-0230

CVE-2019-0230—

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lea

60RISCO

abrir ↗

Referência

CVE-2019-0230

CVE-2019-0230—

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lea

60RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.