Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.724exploits catalogados

35.724CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.455Referência 22.492GitHub PoC 14.286VulnCheck XDB 8.703Nuclei 4.314Metasploit 3.474✓ só verificadosrecentes populares risco

22.492 exploits

Referência

CVE-2009-2338

CVE-2009-2338—

Directory traversal vulnerability in includes/startmodules.inc.php in FreeWebshop.org 2.2.9 R2, when register_globals is

23RISCO

abrir ↗

Referência

CVE-2017-14143

CVE-2017-14143—

The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, wh

60RISCO

abrir ↗

Referência

CVE-2017-14143

CVE-2017-14143—

The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, wh

60RISCO

abrir ↗

Referência✓ VexDay Proof

MOG-WebShop - 'index.php?group' SQL Injection

CVE-2007-6466—webappsphp

Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL

23RISCO

abrir ↗

Referência

CVE-2025-34392

CVE-2025-34392CRITICAL

Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE

53RISCO

abrir ↗

Referência

CVE-2017-2985

CVE-2017-2985—

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in the ActionScript

28RISCO

abrir ↗

Referência

CVE-2016-3715

CVE-2016-3715MEDIUMsob ataque

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi

85RISCO

abrir ↗

Referência

CVE-2018-0878

CVE-2018-0878LOW

Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Window

33RISCO

abrir ↗

Referência

CVE-2009-1493

CVE-2009-1493—

The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and

28RISCO

abrir ↗

Referência

CVE-2017-6542

CVE-2017-6542—

The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large

28RISCO

abrir ↗

Referência✓ VexDay Proof

gf-3xplorer 2.4 - Cross-Site Scripting / Local File Inclusion

CVE-2007-6476—webappsphp

GF-3XPLORER 2.4 allows remote attackers to obtain configuration information via a direct request to explorer/phpinfo.php

23RISCO

abrir ↗

Referência

CVE-2010-3143

CVE-2010-3143—

Untrusted search path vulnerability in Microsoft Windows Contacts allows local users, and possibly remote attackers, to

28RISCO

abrir ↗

Referência

CVE-2010-3227

CVE-2010-3227—

Stack-based buffer overflow in the UpdateFrameTitleForDocument method in the CFrameWnd class in mfc42.dll in the Microso

28RISCO

abrir ↗

Referência

CVE-2005-2842

CVE-2005-2842—

Buffer overflow in dwrcs.exe in DameWare Mini Remote Control before 4.9.0 allows remote attackers to execute arbitrary c

28RISCO

abrir ↗

Referência

CVE-2016-0015

CVE-2016-0015—

DirectShow in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wi

35RISCO

abrir ↗

Referência

CVE-2019-14348

CVE-2019-14348—

The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via

28RISCO

abrir ↗

Referência

CVE-2016-3223

CVE-2016-3223—

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold an

28RISCO

abrir ↗

Referência

CVE-2021-46387

CVE-2021-46387—

ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads t

43RISCO

abrir ↗

Referência

CVE-2019-19368

CVE-2019-19368—

A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1. An attacker ca

43RISCO

abrir ↗

Referência

CVE-2021-44595

CVE-2021-44595—

Wondershare Dr. Fone Latest version as of 2021-12-06 is vulnerable to Incorrect Access Control. A normal user can send m

28RISCO

abrir ↗

Referência

CVE-2014-2908

CVE-2014-2908—

Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x

43RISCO

abrir ↗

Referência

CVE-2019-9955

CVE-2019-9955—

On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, U

43RISCO

abrir ↗

Referência

CVE-2019-9955

CVE-2019-9955—

On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, U

43RISCO

abrir ↗

Referência

CVE-2011-0406

CVE-2011-0406—

Heap-based buffer overflow in HistorySvr.exe in WellinTech KingView 6.53 allows remote attackers to execute arbitrary co

28RISCO

abrir ↗

Referência

CVE-2007-6544

CVE-2007-6544—

Multiple SQL injection vulnerabilities in RunCMS before 1.6.1 allow remote attackers to execute arbitrary SQL commands v

23RISCO

abrir ↗

Referência

CVE-2019-6110

CVE-2019-6110MEDIUM

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-T

38RISCO

abrir ↗

Referência

CVE-2020-9283

CVE-2020-9283—

golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the

28RISCO

abrir ↗

Referência

CVE-2009-4544

CVE-2009-4544—

Cross-site scripting (XSS) vulnerability in kbase/kbase.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows rem

23RISCO

abrir ↗

Referência

CVE-2016-2209

CVE-2016-2209—

Buffer overflow in Dec2SS.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec

28RISCO

abrir ↗

Referência

CVE-2019-1003029

CVE-2019-1003029CRITICALsob ataque

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/

100RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.