Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.866exploits catalogados

35.812CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.458Referência 22.573GitHub PoC 14.316VulnCheck XDB 8.722Nuclei 4.320Metasploit 3.477✓ só verificadosrecentes populares risco

22.573 exploits

Referência

CVE-2010-1956

CVE-2010-1956—

Directory traversal vulnerability in the Gadget Factory (com_gadgetfactory) component 1.0.0 and 1.5.0 for Joomla! allows

43RISCO

abrir ↗

Referência

CVE-2010-1956

CVE-2010-1956—

Directory traversal vulnerability in the Gadget Factory (com_gadgetfactory) component 1.0.0 and 1.5.0 for Joomla! allows

43RISCO

abrir ↗

Referência

CVE-2010-1957

CVE-2010-1957—

Directory traversal vulnerability in the Love Factory (com_lovefactory) component 1.3.4 for Joomla! allows remote attack

43RISCO

abrir ↗

Referência

CVE-2009-4086

CVE-2009-4086—

CRLF injection vulnerability in Xerver HTTP Server 4.31 and 4.32 allows remote attackers to inject arbitrary HTTP header

23RISCO

abrir ↗

Referência

CVE-2020-15238

CVE-2020-15238HIGH

Local privilege escalation Blueman

41RISCO

abrir ↗

Referência

CVE-2013-5218

CVE-2013-5218—

Cross-site scripting (XSS) vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to inject

23RISCO

abrir ↗

Referência

CVE-2012-3755

CVE-2012-3755—

Buffer overflow in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of s

28RISCO

abrir ↗

Referência

CVE-2015-5784

CVE-2015-5784—

runner in Install.framework in the Install Framework Legacy component in Apple OS X before 10.10.5 does not properly dro

23RISCO

abrir ↗

Referência

CVE-2017-15223

CVE-2017-15223—

Denial-of-service vulnerability in ArGoSoft Mini Mail Server 1.0.0.2 and earlier allows remote attackers to waste CPU re

23RISCO

abrir ↗

Referência

CVE-2017-3630

CVE-2017-3630—

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions t

38RISCO

abrir ↗

Referência

CVE-2017-3630

CVE-2017-3630—

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions t

38RISCO

abrir ↗

Referência

CVE-2011-2938

CVE-2011-2938—

Multiple cross-site scripting (XSS) vulnerabilities in filter_api.php in MantisBT before 1.2.7 allow remote attackers to

23RISCO

abrir ↗

Referência

CVE-2014-3842

CVE-2014-3842—

Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow

23RISCO

abrir ↗

Referência

CVE-2021-42136

CVE-2021-42136—

A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows

23RISCO

abrir ↗

Referência

CVE-2019-10874

CVE-2019-10874—

Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to ex

23RISCO

abrir ↗

Referência

CVE-2019-10874

CVE-2019-10874—

Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to ex

23RISCO

abrir ↗

Referência✓ VexDay Proof

Rising AntiVirus Online Scanner - Insecure Method Flaw

CVE-2008-1116—remotewindows

Insecure method vulnerability in the Web Scan Object ActiveX control (OL2005.dll) in Rising Antivirus Online Scanner all

28RISCO

abrir ↗

Referência✓ VexDay Proof

Symphony 1.7.01 (non-patched) - Remote Code Execution

CVE-2008-3591—webappsphp

SQL injection vulnerability in lib/class.admin.php in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attack

23RISCO

abrir ↗

Referência✓ VexDay Proof

PunBB 1.2.16 - Blind Password Recovery

CVE-2008-1484—webappsphp

The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which a

23RISCO

abrir ↗

Referência✓ VexDay Proof

events Calendar 1.1 - Remote File Inclusion

CVE-2008-4673—webappsphp

PHP remote file inclusion vulnerability in panel/common/theme/default/header_setup.php in WebBiscuits Software Events Ca

23RISCO

abrir ↗

Referência

CVE-2012-10059

CVE-2012-10059CRITICAL

Dolibarr ERP/CRM Post-Auth OS Command Injection

63RISCO

abrir ↗

Referência

CVE-2012-10059

CVE-2012-10059CRITICAL

Dolibarr ERP/CRM Post-Auth OS Command Injection

63RISCO

abrir ↗

Referência

CVE-2012-10059

CVE-2012-10059CRITICAL

Dolibarr ERP/CRM Post-Auth OS Command Injection

63RISCO

abrir ↗

Referência

CVE-2018-0880

CVE-2018-0880—

The Desktop Bridge in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an el

23RISCO

abrir ↗

Referência

CVE-2025-35028

CVE-2025-35028CRITICAL

HexStrike AI MCP Server Command Injection

48RISCO

abrir ↗

Referência

CVE-2012-3524

CVE-2012-3524—

libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows

23RISCO

abrir ↗

Referência

CVE-2019-19032

CVE-2019-19032—

XMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is: Arbitrary File Read when an

23RISCO

abrir ↗

Referência

CVE-2018-13457

CVE-2018-13457—

qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to

23RISCO

abrir ↗

Referência

CVE-2014-1906

CVE-2014-1906—

Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5

23RISCO

abrir ↗

Referência✓ VexDay Proof

fresh email script 1.0 - Multiple Vulnerabilities

CVE-2008-7043—webappsphp

Cross-site scripting (XSS) vulnerability in register.php in FreshScripts Fresh Email Script 1.0 through 1.11 allows remo

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.