Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.620exploits catalogados

35.647CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.455Referência 22.429GitHub PoC 14.270VulnCheck XDB 8.693Nuclei 4.299Metasploit 3.474✓ só verificadosrecentes populares risco

22.429 exploits

Referência

CVE-2023-1671

CVE-2023-1671CRITICALsob ataque

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10

100RISCO

abrir ↗

Referência

CVE-2019-7256

CVE-2019-7256CRITICALsob ataque

Linear eMerge E3-Series devices allow Command Injections.

100RISCO

abrir ↗

Referência

CVE-2026-19791

CVE-2026-19791HIGH

Tenda G0 httpd web management interface module addStaticRoute stack-based overflow

41RISCO

abrir ↗

Referência

CVE-2026-19790

CVE-2026-19790HIGH

Tenda G0 httpd Web Management module formSetPortMirror stack-based overflow

41RISCO

abrir ↗

Referência

CVE-2026-19789

CVE-2026-19789HIGH

Tenda AC1206 httpd web management interface WifiGuestSet set_wl_guest_iplist stack-based overflow

41RISCO

abrir ↗

Referência

CVE-2026-19788

CVE-2026-19788HIGH

Tenda AC1206 httpd web management interface SetOnlineDevName set_device_name stack-based overflow

41RISCO

abrir ↗

Referência✓ VexDay Proof

DomPHP 0.81 - 'cat' SQL Injection

CVE-2008-6064—webappsphp

Multiple SQL injection vulnerabilities in DomPHP 0.81 allow remote attackers to execute arbitrary SQL commands via the c

23RISCO

abrir ↗

Referência

CVE-2023-26360

CVE-2023-26360HIGHsob ataque

Adobe ColdFusion Improper Access Control Arbitrary code execution

100RISCO

abrir ↗

Referência

CVE-2021-44790

CVE-2021-44790—

Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier

45RISCO

abrir ↗

Referência

CVE-2018-9206

CVE-2018-9206—

Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

60RISCO

abrir ↗

Referência

CVE-2026-7672

CVE-2026-7672MEDIUM

youlaitech youlai-boot Users Endpoint UserController.java getUserList sql injection

33RISCO

abrir ↗

Referência

CVE-2026-7671

CVE-2026-7671MEDIUM

CodeWise Tornet Scooter Mobile App TwoFactor excessive authentication

33RISCO

abrir ↗

Referência

CVE-2026-7669

CVE-2026-7669MEDIUM

sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection

33RISCO

abrir ↗

Referência

CVE-2026-7669

CVE-2026-7669MEDIUM

sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection

33RISCO

abrir ↗

Referência

CVE-2026-7668

CVE-2026-7668MEDIUM

MikroTik RouterOS SCEP Endpoint scep.p ASN1_STRING_data out-of-bounds

33RISCO

abrir ↗

Referência

CVE-2026-7653

CVE-2026-7653MEDIUM

r-huijts mcp-server-rijksmuseum MCP index.ts open_image_in_browser os command injection

33RISCO

abrir ↗

Referência

CVE-2026-56122

CVE-2026-56122HIGH

Winstone Servlet Engine 0.9.10 Path Traversal via HTTP Request Paths

41RISCO

abrir ↗

Referência

CVE-2026-56121

CVE-2026-56121CRITICAL

Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization

48RISCO

abrir ↗

Referência

CVE-2026-56111

CVE-2026-56111HIGH

Marlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code Handler

41RISCO

abrir ↗

Referência✓ VexDay Proof

Prozilla Hosting Index - 'id' SQL Injection

CVE-2008-6115—webappsphp

SQL injection vulnerability in directory.php in Prozilla Hosting Index allows remote attackers to execute arbitrary SQL

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component Thyme 1.0 - SQL Injection

CVE-2008-6116—webappsphp

SQL injection vulnerability in the EXtrovert Software Thyme (com_thyme) 1.0 component for Joomla! allows remote attacker

23RISCO

abrir ↗

Referência✓ VexDay Proof

WebBiscuits Modules Controller 1.1 - Remote File Inclusion / Remote File Disclosure

CVE-2008-6139—webappsphp

Directory traversal vulnerability in faqsupport/wce.download.php in WebBiscuits Modules Controller 1.1 allows remote att

23RISCO

abrir ↗

Referência

CVE-2026-7384

CVE-2026-7384MEDIUM

ezequiroga mcp-bases research_server.py search_papers path traversal

33RISCO

abrir ↗

Referência✓ VexDay Proof

OwenPoll 1.0 - Insecure Cookie Handling

CVE-2008-6143—webappsphp

OwenPoll 1.0 allows remote attackers to bypass authentication and obtain administrative access via a modified account na

23RISCO

abrir ↗

Referência✓ VexDay Proof

Enthrallweb emates 1.0 - 'newsdetail.asp' SQL Injection

CVE-2006-6806—webappsasp

SQL injection vulnerability in newsdetail.asp in Enthrallweb eMates 1.0 allows remote attackers to execute arbitrary SQL

23RISCO

abrir ↗

Referência✓ VexDay Proof

DeluxeBB 1.2 - Blind SQL Injection

CVE-2008-6146—webappsphp

SQL injection vulnerability in pm.php in DeluxeBB 1.2 and earlier, when magic_quotes_gpc is disabled, allows remote atta

23RISCO

abrir ↗

Referência✓ VexDay Proof

Ananda Real Estate 3.4 - 'agent' SQL Injection

CVE-2006-6807—webappsasp

SQL injection vulnerability in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 and earlier all

23RISCO

abrir ↗

Referência

CVE-2026-9815

CVE-2026-9815MEDIUM

MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCE

33RISCO

abrir ↗

Referência

CVE-2026-55200

CVE-2026-55200CRITICAL

libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c

48RISCO

abrir ↗

Referência

CVE-2026-10236

CVE-2026-10236MEDIUM

SourceCodester Water Billing Management System User Management Endpoint Users.php save improper authorization

33RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.