Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.866exploits catalogados

35.812CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.458Referência 22.573GitHub PoC 14.316VulnCheck XDB 8.722Nuclei 4.320Metasploit 3.477✓ só verificadosrecentes populares risco

22.573 exploits

Referência✓ VexDay Proof

wbstreet 1.0 - SQL Injection / File Disclosure

CVE-2008-5956—webappsphp

Wbstreet (aka PHPSTREET Webboard) 1.0 stores sensitive information under the web root with insufficient access control,

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHP-Generics 1.0.0 Beta - Multiple Remote File Inclusions

CVE-2007-2346—webappsphp

Multiple PHP remote file inclusion vulnerabilities in PHP-Generics 1.0 beta allow remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência✓ VexDay Proof

Glossword 1.8.1 - 'custom_vars.php' Remote File Inclusion

CVE-2007-2743—webappsphp

PHP remote file inclusion vulnerability in custom_vars.php in GlossWord 1.8.1 allows remote attackers to execute arbitra

23RISCO

abrir ↗

Referência✓ VexDay Proof

CounterPath X-Lite 3.x - SIP phone Remote Denial of Service

CVE-2007-4382—doswindows

CounterPath X-Lite 3.0 34025, and possibly eyeBeam, allows remote attackers to cause a denial of service (device crash)

23RISCO

abrir ↗

Referência

CVE-2012-6644

CVE-2012-6644—

Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.6 allow remote attackers to inject arbitrary web scr

23RISCO

abrir ↗

Referência

CVE-2018-0715

CVE-2018-0715—

Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inje

23RISCO

abrir ↗

Referência

CVE-2026-17530

CVE-2026-17530MEDIUM

AstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorization

33RISCO

abrir ↗

Referência

CVE-2019-3474

CVE-2019-3474MEDIUM

Path traversal vulnerability in Filr web application

33RISCO

abrir ↗

Referência

CVE-2026-17529

CVE-2026-17529MEDIUM

AstrBotDevs AstrBot astr_main_agent.py authorization

33RISCO

abrir ↗

Referência

CVE-2016-4004

CVE-2016-4004—

Directory traversal vulnerability in Dell OpenManage Server Administrator (OMSA) 8.2 allows remote authenticated adminis

23RISCO

abrir ↗

Referência

CVE-2026-5813

CVE-2026-5813MEDIUM

PHPGurukul Online Course Registration check_availability.php sql injection

33RISCO

abrir ↗

Referência✓ VexDay Proof

webid 0.5.4 - Multiple Vulnerabilities

CVE-2008-7117—webappsphp

eledicss.php in WeBid auction script 0.5.4 allows remote attackers to modify arbitrary cascading style sheets (CSS) file

23RISCO

abrir ↗

Referência

CVE-2021-41382

CVE-2021-41382—

Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface.

23RISCO

abrir ↗

Referência

CVE-2023-38357

CVE-2023-38357—

Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized a

23RISCO

abrir ↗

Referência

CVE-2023-4490

CVE-2023-4490CRITICAL

WP Job Portal < 2.0.6 - Unauthenticated SQLi

63RISCO

abrir ↗

Referência

CVE-2026-49491

CVE-2026-49491HIGH

Pixa Bank 2.0 SQL Injection via agence-ajax.php API

41RISCO

abrir ↗

Referência

CVE-2018-18955

CVE-2018-18955—

In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat

38RISCO

abrir ↗

Referência✓ VexDay Proof

TorrentTrader Classic 1.09 - Multiple Vulnerabilities

CVE-2009-2157—webappsphp

Multiple SQL injection vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to execute arbitra

23RISCO

abrir ↗

Referência

CVE-2026-5812

CVE-2026-5812MEDIUM

SourceCodester Pharmacy Product Management System POST Parameter add-sales.php logic error

33RISCO

abrir ↗

Referência

CVE-2011-5183

CVE-2011-5183—

Multiple SQL injection vulnerabilities in OrderSys 1.6.4 and earlier allow remote attackers to execute arbitrary SQL com

23RISCO

abrir ↗

Referência

CVE-2010-2698

CVE-2010-2698—

Multiple cross-site scripting (XSS) vulnerabilities in Sijio Community Software allow remote authenticated users to inje

23RISCO

abrir ↗

Referência

CVE-2012-2905

CVE-2012-2905—

Artiphp CMS 5.5.0 Neo (r422) stores database backups with predictable names under the web root with insufficient access

23RISCO

abrir ↗

Referência

CVE-2024-24724

CVE-2024-24724CRITICAL

Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Re

53RISCO

abrir ↗

Referência

CVE-2017-8912

CVE-2017-8912HIGH

CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code para

41RISCO

abrir ↗

Referência

CVE-2018-6364

CVE-2018-6364—

SQL Injection exists in Multilanguage Real Estate MLM Script through 3.0 via the /product-list.php srch parameter.

23RISCO

abrir ↗

Referência

CVE-2018-6364

CVE-2018-6364—

SQL Injection exists in Multilanguage Real Estate MLM Script through 3.0 via the /product-list.php srch parameter.

23RISCO

abrir ↗

Referência

CVE-2009-4222

CVE-2009-4222—

phpBazar 2.1.1fix and earlier does not require administrative authentication for admin/admin.php, which allows remote at

23RISCO

abrir ↗

Referência

CVE-2010-4901

CVE-2010-4901—

Multiple cross-site scripting (XSS) vulnerabilities in char_map.php in MySource Matrix 3.28.3 allow remote attackers to

23RISCO

abrir ↗

Referência✓ VexDay Proof

Stash 1.0.3 - Multiple SQL Injections

CVE-2008-4080—webappsphp

SQL injection vulnerability in Stash 1.0.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitr

23RISCO

abrir ↗

Referência✓ VexDay Proof

ExBB Italiano 0.2 - exbb[home_path] Remote File Inclusion

CVE-2006-4488—webappsphp

PHP remote file inclusion vulnerability in modules/userstop/userstop.php in ExBB Italia 0.2 and earlier, when register_g

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.