Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.057exploits catalogados

36.288CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.460Referência 22.910GitHub PoC 14.997VulnCheck XDB 8.843Nuclei 4.358Metasploit 3.489✓ só verificadosrecentes populares risco

5.629 exploits

Referência✓ VexDay Proof

Softbiz Recipes Portal Script - SQL Injection

CVE-2007-5449—webappsphp

SQL injection vulnerability in searchresult.php in Softbiz Recipes Portal Script allows remote attackers to execute arbi

23RISCO

abrir ↗

Referência✓ VexDay Proof

MyPicGallery 1.0 - Arbitrary Add Admin

CVE-2008-2347—webappsphp

MyPicGallery 1.0 allows remote attackers to bypass application authentication and gain administrative access by setting

23RISCO

abrir ↗

Referência✓ VexDay Proof

Apple iTouch/iPhone 1.1.1 - '.tif' Remote Privilege Escalation 'Jailbreak'

CVE-2007-5450—remoteios

Unspecified vulnerability in Safari on the Apple iPod touch (aka iTouch) and iPhone 1.1.1 allows user-assisted remote at

23RISCO

abrir ↗

Referência✓ VexDay Proof

odars CMS 1.0.2 - Remote File Inclusion

CVE-2008-2885—webappsphp

PHP remote file inclusion vulnerability in src/browser/resource/categories/resource_categories_view.php in Open Digital

23RISCO

abrir ↗

Referência✓ VexDay Proof

Stash 1.0.3 - Insecure Cookie Handling

CVE-2008-4081—webappsphp

admin/login.php in Stash 1.0.3 allows remote attackers to bypass authentication and gain administrative access by settin

23RISCO

abrir ↗

Referência✓ VexDay Proof

Atomic Photo Album 1.1.0pre4 - Insecure Cookie Handling

CVE-2008-4714—webappsphp

Atomic Photo Album 1.1.0 pre4 does not properly handle the apa_cookie_login and apa_cookie_password cookies, which proba

23RISCO

abrir ↗

Referência✓ VexDay Proof

SG Real Estate Portal 2.0 - Insecure Cookie Handling

CVE-2008-6009—webappsphp

SG Real Estate Portal 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the

23RISCO

abrir ↗

Referência✓ VexDay Proof

A+ PHP Scripts - Nms Insecure Cookie Handling

CVE-2008-6667—webappsphp

A+ PHP Scripts News Management System (NMS) allows remote attackers to bypass authentication and gain administrator priv

23RISCO

abrir ↗

Referência✓ VexDay Proof

FretsWeb 1.2 - 'name' Blind SQL Injection

CVE-2009-2113—webappsphp

Multiple SQL injection vulnerabilities in FretsWeb 1.2 allow remote attackers to execute arbitrary SQL commands via the

23RISCO

abrir ↗

Referência✓ VexDay Proof

Online Fantasy Football League (OFFL) 0.2.6 - 'teams.php' SQL Injection

CVE-2008-2890—webappsphp

Multiple SQL injection vulnerabilities in Online Fantasy Football League (OFFL) 0.2.6 and earlier allow remote attackers

23RISCO

abrir ↗

Referência✓ VexDay Proof

Light Weight Calendar 1.x - 'date' Remote Code Execution

CVE-2006-1252—webappsphp

Eval injection vulnerability in cal.php in Light Weight Calendar (LWC) 1.0 allows remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência✓ VexDay Proof

Calendar Script 1.1 - Insecure Cookie Handling

CVE-2008-5738—webappsphp

Nodstrum MySQL Calendar 1.1 and 1.2 allows remote attackers to bypass authentication and gain administrative access by s

23RISCO

abrir ↗

Referência✓ VexDay Proof

Yahoo! Messenger 8.1.0.421 - CYFT Object Arbitrary File Download

CVE-2007-5017—remotewindows

Absolute path traversal vulnerability in a certain ActiveX control in the CYFT object in ft60.dll in Yahoo! Messenger 8.

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHPAuctionSystem - Insecure Cookie Handling

CVE-2009-0108—webappsphp

PHPAuctions (aka PHPAuctionSystem) allows remote attackers to bypass authentication and gain administrative access via m

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component EXP Shop - 'catid' SQL Injection

CVE-2008-2892—webappsphp

SQL injection vulnerability in the EXP Shop (com_expshop) component 1.0 for Joomla! allows remote attackers to execute a

23RISCO

abrir ↗

Referência✓ VexDay Proof

Docebo 3.5.0.3 - 'lib.regset.php' Command Execution

CVE-2008-7154—webappsphp

Docebo 3.5.0.3 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) class/cla

23RISCO

abrir ↗

Referência✓ VexDay Proof

Power Editor 2.0 - Remote File Disclosure / Edit

CVE-2008-2116—webappsphp

Multiple directory traversal vulnerabilities in editor.php in ScriptsEZ.net Power Editor 2.0 allow remote attackers to r

23RISCO

abrir ↗

Referência✓ VexDay Proof

TorrentFlux 2.2 - 'maketorrent.php' Remote Command Execution

CVE-2006-6599—webappsphp

maketorrent.php in TorrentFlux 2.2 allows remote authenticated users to execute arbitrary commands via shell metacharact

23RISCO

abrir ↗

Referência✓ VexDay Proof

AJ HYIP ACME - 'news.php' SQL Injection

CVE-2008-2893—webappsphp

SQL injection vulnerability in news.php in AJ Square aj-hyip (aka AJ HYIP Acme) allows remote attackers to execute arbit

23RISCO

abrir ↗

Referência✓ VexDay Proof

project alumni 1.0.9 - 'index.php?act' Local File Inclusion

CVE-2007-6184—webappsphp

Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute ar

23RISCO

abrir ↗

Referência✓ VexDay Proof

Mega File Hosting Script 1.2 - 'url' Remote File Inclusion

CVE-2009-0966—webappsphp

PHP remote file inclusion vulnerability in cross.php in YABSoft Mega File Hosting 1.2 allows remote attackers to execute

23RISCO

abrir ↗

Referência✓ VexDay Proof

PageSquid CMS 0.3 Beta - 'index.php' SQL Injection

CVE-2008-2897—webappsphp

SQL injection vulnerability in index.php in PageSquid CMS 0.3 Beta allows remote attackers to execute arbitrary SQL comm

23RISCO

abrir ↗

Referência✓ VexDay Proof

Chicomas 2.0.4 - Database Backup / File Disclosure / Cross-Site Scripting

CVE-2008-5853—webappsphp

Chilek Content Management System (aka ChiCoMaS) 2.0.4 and earlier stores sensitive information under the web root with i

23RISCO

abrir ↗

Referência✓ VexDay Proof

Absolute FAQ Manager 6.0 - Insecure Cookie Handling

CVE-2008-6854—webappsphp

Xigla Software Absolute FAQ Manager.NET 6.0 allows remote attackers to bypass authentication and gain administrative acc

23RISCO

abrir ↗

Referência✓ VexDay Proof

fungamez rc1 - Authentication Bypass / Local File Inclusion

CVE-2009-1489—webappsphp

includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by set

23RISCO

abrir ↗

Referência✓ VexDay Proof

Teraway LinkTracker 1.0 - Insecure Cookie Handling

CVE-2009-1617—webappsphp

Teraway LinkTracker 1.0 allows remote attackers to bypass authentication and gain administrative access via a userid=1&l

23RISCO

abrir ↗

Referência✓ VexDay Proof

Prozilla Topsites 1.0 - Arbitrary Edit/Add Users

CVE-2008-1784—webappsphp

Prozilla Topsites 1.0 allows remote attackers to perform administrative actions via a direct request to (1) addu.php, (2

23RISCO

abrir ↗

Referência✓ VexDay Proof

Ixprim CMS 1.2 - Blind SQL Injection

CVE-2006-6755—webappsphp

Ixprim 1.2 allows remote attackers to obtain sensitive information via a direct request for kernel/plugins/fckeditor2/ix

23RISCO

abrir ↗

Referência✓ VexDay Proof

realm CMS 2.3 - Multiple Vulnerabilities

CVE-2008-2682—webappsphp

_RealmAdmin/login.asp in Realm CMS 2.3 and earlier allows remote attackers to bypass authentication and access admin pag

23RISCO

abrir ↗

Referência✓ VexDay Proof

hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities

CVE-2007-6499—webappsasp

Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to uninsta

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.