Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.837exploits catalogados

35.811CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.455Referência 22.572GitHub PoC 14.291VulnCheck XDB 8.722Nuclei 4.320Metasploit 3.477✓ só verificadosrecentes populares risco

22.549 exploits

Referência✓ VexDay Proof

iziContents rc6 - Local/Remote File Inclusion

CVE-2005-4600—webappsphp

Directory traversal vulnerability in tiny_mce_gzip.php in TinyMCE Compressor PHP before 1.06 allows remote attackers to

23RISCO

abrir ↗

Referência

CVE-2009-4216

CVE-2009-4216—

Directory traversal vulnerability in funzioni/lib/menulast.php in klinza professional cms 5.0.1 and earlier allows remot

23RISCO

abrir ↗

Referência

CVE-2002-1966

CVE-2002-1966—

Directory traversal vulnerability in magiccard.cgi in My Postcards Platinum 5.0 and 6.0 allows remote attackers to read

23RISCO

abrir ↗

Referência✓ VexDay Proof

addalink 4 Beta - Write Approved Links

CVE-2008-4146—webappsphp

Addalink 1.0 beta 4 and earlier allows remote attackers to (1) approve web-site additions via a modified approved field

23RISCO

abrir ↗

Referência✓ VexDay Proof

KnowledgeBuilder 2.2 - 'visEdit_root' Remote File Inclusion

CVE-2006-5919—webappsphp

PHP remote file inclusion vulnerability in admin/e_data/visEdit_control.class.php in ActiveCampaign KnowledgeBuilder 2.2

23RISCO

abrir ↗

Referência

CVE-2011-5172

CVE-2011-5172—

Stack-based buffer overflow in StoryBoard Quick 6 Build 3786, and possibly StoryBoard Artist and StoryBoard Studio, allo

23RISCO

abrir ↗

Referência✓ VexDay Proof

Diesel Joke Site - 'picture_category.php' SQL Injection

CVE-2008-4150—webappsphp

SQL injection vulnerability in picture_category.php in Diesel Joke Site allows remote attackers to execute arbitrary SQL

23RISCO

abrir ↗

Referência

CVE-2025-5298

CVE-2025-5298MEDIUM

Campcodes Online Hospital Management System betweendates-detailsreports.php sql injection

33RISCO

abrir ↗

Referência

CVE-2015-2564

CVE-2015-2564—

SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to

23RISCO

abrir ↗

Referência

CVE-2015-2564

CVE-2015-2564—

SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to

23RISCO

abrir ↗

Referência

CVE-2025-34125

CVE-2025-34125CRITICAL

D-Link DSP-W110A1 Cookie Command Injection

63RISCO

abrir ↗

Referência

CVE-2025-34125

CVE-2025-34125CRITICAL

D-Link DSP-W110A1 Cookie Command Injection

63RISCO

abrir ↗

Referência

CVE-2025-34125

CVE-2025-34125CRITICAL

D-Link DSP-W110A1 Cookie Command Injection

63RISCO

abrir ↗

Referência

CVE-2019-9184

CVE-2019-9184—

SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbitr

23RISCO

abrir ↗

Referência

CVE-2011-5233

CVE-2011-5233—

Heap-based buffer overflow in IrfanView before 4.32 allows remote attackers to execute arbitrary code via crafted "Rows

23RISCO

abrir ↗

Referência

CVE-2019-6224

CVE-2019-6224—

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Mojave 10.

23RISCO

abrir ↗

Referência

CVE-2013-4985

CVE-2013-4985—

Multiple Vivotek IP Cameras remote authentication bypass that could allow access to the video stream

23RISCO

abrir ↗

Referência

CVE-2026-2017

CVE-2026-2017CRITICAL

IP-COM W30AP POST Request wx3auth R7WebsSecurityHandler stack-based overflow

48RISCO

abrir ↗

Referência

CVE-2017-16884

CVE-2017-16884—

Cross-site scripting (XSS) vulnerability in MistServer before 2.13 allows remote attackers to inject arbitrary web scrip

23RISCO

abrir ↗

Referência

CVE-2017-16884

CVE-2017-16884—

Cross-site scripting (XSS) vulnerability in MistServer before 2.13 allows remote attackers to inject arbitrary web scrip

23RISCO

abrir ↗

Referência

CVE-2018-16302

CVE-2018-16302—

MediaComm Zip-n-Go before 4.95 has a Buffer Overflow via a crafted file.

23RISCO

abrir ↗

Referência✓ VexDay Proof

Exodus 0.10 - URI Handler Arbitrary Parameter Injection (2)

CVE-2008-6936—remotewindows

Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, over

23RISCO

abrir ↗

Referência

CVE-2016-5348

CVE-2016-5348—

The GPS component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 be

23RISCO

abrir ↗

Referência

CVE-2008-4178

CVE-2008-4178—

SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and D

23RISCO

abrir ↗

Referência

CVE-2012-6644

CVE-2012-6644—

Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.6 allow remote attackers to inject arbitrary web scr

23RISCO

abrir ↗

Referência

CVE-2008-4178

CVE-2008-4178—

SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and D

23RISCO

abrir ↗

Referência✓ VexDay Proof

IrfanView 4.00 - '.iff' Local Buffer Overflow

CVE-2007-2363—localwindows

Buffer overflow in IrfanView 4.00 and earlier allows user-assisted remote attackers to execute arbitrary code via a craf

23RISCO

abrir ↗

Referência

CVE-2011-5177

CVE-2011-5177—

Multiple cross-site scripting (XSS) vulnerabilities in admin/controller.php in eSyndiCat Pro 2.3.05 allow remote attacke

23RISCO

abrir ↗

Referência

CVE-2014-5347

CVE-2014-5347—

Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress

23RISCO

abrir ↗

Referência✓ VexDay Proof

SaturnCMS - Blind SQL Injection

CVE-2008-6263—webappsphp

SQL injection vulnerability in lib/user/t_user.php in SaturnCMS allows remote attackers to execute arbitrary SQL command

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.