Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.107exploits catalogados

36.322CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.464Referência 22.936GitHub PoC 15.010VulnCheck XDB 8.846Nuclei 4.361Metasploit 3.490✓ só verificadosrecentes populares risco

22.573 exploits

Referência

CVE-2015-0802

CVE-2015-0802—

Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl

50RISCO

abrir ↗

Referência

CVE-2013-3628

CVE-2013-3628—

Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability

50RISCO

abrir ↗

Referência

CVE-2008-4687

CVE-2008-4687—

manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort param

50RISCO

abrir ↗

Referência✓ VexDay Proof

Simple Document Management System 1.1.4 - Authentication Bypass

CVE-2008-6220—webappsphp

SQL injection vulnerability in login.php in Simple Document Management System (SDMS) 1.1.5 and 1.1.4, and possibly earli

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHP Auto Listings - 'pg' SQL Injection

CVE-2008-6226—webappsphp

SQL injection vulnerability in moreinfo.php in Pre Projects PHP Auto Listings Script, when magic_quotes_gpc is disabled,

23RISCO

abrir ↗

Referência

SugarCRM CE 6.3.1 - 'Unserialize()' PHP Code Execution

CVE-2012-0694—webappsphp

SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers

50RISCO

abrir ↗

Referência

CVE-2020-24949

CVE-2020-24949—

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a cr

50RISCO

abrir ↗

Referência

CVE-2012-6519

CVE-2012-6519—

SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL co

23RISCO

abrir ↗

Referência

CVE-2024-3552

CVE-2024-3552CRITICAL

Web Directory Free < 1.7.0 - Unauthenticated SQL Injection

75RISCO

abrir ↗

Referência

CVE-2015-7765

CVE-2015-7765—

ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser a

50RISCO

abrir ↗

Referência

CVE-2015-7765

CVE-2015-7765—

ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser a

50RISCO

abrir ↗

Referência

CVE-2013-3928

CVE-2013-3928—

Stack-based buffer overflow in the ReadFile function in flt_BMP.dll in Chasys Draw IES before 4.11.02 allows remote atta

50RISCO

abrir ↗

Referência

CVE-2012-6522

CVE-2012-6522—

Directory traversal vulnerability in the getContent function in codes/wcms.php in w-CMS 2.01 allows remote attackers to

23RISCO

abrir ↗

Referência

CVE-2021-36934

CVE-2021-36934HIGHsob ataque

Windows Elevation of Privilege Vulnerability

98RISCO

abrir ↗

Referência✓ VexDay Proof

Sitellite CMS 4.2.12 - '559668.php' Remote File Inclusion

CVE-2007-3228—webappsphp

PHP remote file inclusion vulnerability in saf/lib/PEAR/PhpDocumentor/Documentation/tests/bug-559668.php in Sitellite CM

35RISCO

abrir ↗

Referência✓ VexDay Proof

glFusion 1.1.2 - 'COM_applyFilter()/cookies' Blind SQL Injection

CVE-2009-1282—webappsphp

SQL injection vulnerability in private/system/lib-session.php in glFusion 1.1.2 and earlier allows remote attackers to e

23RISCO

abrir ↗

Referência

CVE-2014-6593

CVE-2014-6593—

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.

50RISCO

abrir ↗

Referência

CVE-2018-8145

CVE-2018-8145—

An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could

35RISCO

abrir ↗

Referência

CVE-2025-25257

CVE-2025-25257CRITICALsob ataque

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi

100RISCO

abrir ↗

Referência✓ VexDay Proof

PreProject Multi-Vendor Shopping Malls - Multiple Vulnerabilities

CVE-2008-6228—webappsphp

Pre Multi-Vendor Shopping Malls allows remote attackers to bypass authentication and gain administrative access by setti

23RISCO

abrir ↗

Referência✓ VexDay Proof

Pre Shopping Mall - Insecure Cookie Handling

CVE-2008-6232—webappsphp

Pre Shopping Mall allows remote attackers to bypass authentication and gain administrative access by setting the (1) adm

23RISCO

abrir ↗

Referência

Sophos XG115w Firewall 17.0.10 MR-10 - Authentication Bypass

CVE-2022-1040CRITICALsob ataquewebappshardware

An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sopho

100RISCO

abrir ↗

Referência✓ VexDay Proof

Harlandscripts drinks - 'recid' SQL Injection

CVE-2008-6233—webappsphp

SQL injection vulnerability in index.php in Five Dollar Scripts Drinks script allows remote attackers to execute arbitra

23RISCO

abrir ↗

Referência

CVE-2012-6524

CVE-2012-6524—

SQL injection vulnerability in kommentar.php in pGB 2.12 allows remote attackers to execute arbitrary SQL commands via t

23RISCO

abrir ↗

Referência

CVE-2015-0816

CVE-2015-0816—

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource

50RISCO

abrir ↗

Referência

CVE-2013-3928

CVE-2013-3928—

Stack-based buffer overflow in the ReadFile function in flt_BMP.dll in Chasys Draw IES before 4.11.02 allows remote atta

50RISCO

abrir ↗

Referência✓ VexDay Proof

Mambo Component com_Musica - 'id' SQL Injection

CVE-2008-6234—webappsphp

SQL injection vulnerability in the com_musica module in Joomla! and Mambo allows remote attackers to execute arbitrary S

23RISCO

abrir ↗

Referência✓ VexDay Proof

SFS EZ Software - 'id' SQL Injection

CVE-2008-6237—webappsphp

SQL injection vulnerability in software-description.php in Scripts For Sites (SFS) Hotscripts-like Site allows remote at

23RISCO

abrir ↗

Referência

CVE-2019-13101

CVE-2019-13101—

An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without

50RISCO

abrir ↗

Referência✓ VexDay Proof

Flexphpsite 0.0.1 - Authentication Bypass

CVE-2008-6241—webappsphp

Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPSite 0.0.1 and 0.0.7, when magic_quotes_gpc is d

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.