Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.813exploits catalogados

35.788CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.455Referência 22.549GitHub PoC 14.290VulnCheck XDB 8.722Nuclei 4.320Metasploit 3.477✓ só verificadosrecentes populares risco

22.549 exploits

Referência✓ VexDay Proof

PHPKB Knowledge Base Software 1.5 - 'ID' SQL Injection

CVE-2008-1909—webappsphp

SQL injection vulnerability in comment.php in PHP Knowledge Base (PHPKB) 1.5 and 2.0 allows remote attackers to execute

23RISCO

abrir ↗

Referência

CVE-2010-5012

CVE-2010-5012—

SQL injection vulnerability in new.php in DaLogin 2.2 and 2.2.5 allows remote attackers to execute arbitrary SQL command

23RISCO

abrir ↗

Referência

CVE-2010-5012

CVE-2010-5012—

SQL injection vulnerability in new.php in DaLogin 2.2 and 2.2.5 allows remote attackers to execute arbitrary SQL command

23RISCO

abrir ↗

Referência

CVE-2010-5013

CVE-2010-5013—

SQL injection vulnerability in listing_detail.asp in Mckenzie Creations Virtual Real Estate Manager (VRM) 3.5 allows rem

23RISCO

abrir ↗

Referência

CVE-2024-4620

CVE-2024-4620CRITICAL

ArForms < 6.6 - Unauthenticated RCE

63RISCO

abrir ↗

Referência

CVE-2021-43701

CVE-2021-43701—

CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/articl

23RISCO

abrir ↗

Referência

CVE-2011-0018

CVE-2011-0018—

The email function in manage_sql.c in OpenVAS Manager 1.0.x through 1.0.3 and 2.0.x through 2.0rc2 allows remote authent

23RISCO

abrir ↗

Referência

CVE-2012-5335

CVE-2012-5335—

Directory traversal vulnerability in Tiny Server 1.1.5 allows remote authenticated users to read arbitrary files via a .

23RISCO

abrir ↗

Referência

CVE-2021-46416

CVE-2021-46416MEDIUM

Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups acce

33RISCO

abrir ↗

Referência

CVE-2016-10079

CVE-2016-10079—

SAPlpd through 7400.3.11.33 in SAP GUI 7.40 on Windows has a Denial of Service vulnerability (service crash) with a long

23RISCO

abrir ↗

Referência

CVE-2006-5190

CVE-2006-5190—

Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers t

23RISCO

abrir ↗

Referência

CVE-2010-5013

CVE-2010-5013—

SQL injection vulnerability in listing_detail.asp in Mckenzie Creations Virtual Real Estate Manager (VRM) 3.5 allows rem

23RISCO

abrir ↗

Referência

CVE-2010-5014

CVE-2010-5014—

SQL injection vulnerability in standings.php in Elite Gaming Ladders 3.5 allows remote attackers to execute arbitrary SQ

23RISCO

abrir ↗

Referência

CVE-2010-0753

CVE-2010-0753—

SQL injection vulnerability in the SQL Reports (com_sqlreport) component 1.1 for Joomla! allows remote attackers to exec

23RISCO

abrir ↗

Referência

CVE-2010-0753

CVE-2010-0753—

SQL injection vulnerability in the SQL Reports (com_sqlreport) component 1.1 for Joomla! allows remote attackers to exec

23RISCO

abrir ↗

Referência

CVE-2018-5688

CVE-2018-5688—

ILIAS before 5.2.4 has XSS via the cmd parameter to the displayHeader function in setup/classes/class.ilSetupGUI.php in

23RISCO

abrir ↗

Referência

CVE-2019-8391

CVE-2019-8391—

qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter.

23RISCO

abrir ↗

Referência

CVE-2017-13156

CVE-2017-13156—

An elevation of privilege vulnerability in the Android system (art). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0,

43RISCO

abrir ↗

Referência

CVE-2001-0198

CVE-2001-0198—

Buffer overflow in QuickTime Player plugin 4.1.2 (Japanese) allows remote attackers to execute arbitrary commands via a

23RISCO

abrir ↗

Referência

CVE-2019-15811

CVE-2019-15811—

In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.

38RISCO

abrir ↗

Referência

CVE-2012-2376

CVE-2012-2376—

Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execut

28RISCO

abrir ↗

Referência

CVE-2015-0555

CVE-2015-0555—

Buffer overflow in the XnsSdkDeviceIpInstaller.ocx ActiveX control in Samsung iPOLiS Device Manager 1.12.2 allows remote

23RISCO

abrir ↗

Referência

CVE-2025-15501

CVE-2025-15501CRITICAL

Sangfor Operation and Maintenance Management System getCmd WriterHandle.getCmd os command injection

48RISCO

abrir ↗

Referência

CVE-2023-0744

CVE-2023-0744CRITICAL

Improper Access Control in answerdev/answer

48RISCO

abrir ↗

Referência

CVE-2010-5022

CVE-2010-5022—

SQL injection vulnerability in the JExtensions JE Story Submit (com_jesubmit) component 1.4 for Joomla! allows remote at

23RISCO

abrir ↗

Referência✓ VexDay Proof

phpChess Community Edition 2.0 - Multiple Remote File Inclusions

CVE-2007-2677—webappsphp

Multiple PHP remote file inclusion vulnerabilities in phpChess Community Edition 2.0 allow remote attackers to execute a

23RISCO

abrir ↗

Referência✓ VexDay Proof

LightBlog 9.5 - 'cp_upload_image.php' Arbitrary File Upload

CVE-2008-0632—webappsphp

Unrestricted file upload vulnerability in cp_upload_image.php in LightBlog 9.5 allows remote attackers to execute arbitr

23RISCO

abrir ↗

Referência✓ VexDay Proof

VBA32 Personal AntiVirus 3.12.8.x - Malformed Archive Denial of Service

CVE-2008-5667—doswindows

The scanning engine in VirusBlokAda VBA32 Personal Antivirus 3.12.8.x allows remote attackers to cause a denial of servi

23RISCO

abrir ↗

Referência

CVE-2010-5023

CVE-2010-5023—

SQL injection vulnerability in index.asp in Digital Interchange Calendar 5.8.5 allows remote attackers to execute arbitr

23RISCO

abrir ↗

Referência

CVE-2020-25453

CVE-2020-25453—

An issue was discovered in BlackCat CMS before 1.4. There is a CSRF vulnerability (bypass csrf_token) that allows remote

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.