Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.900exploits catalogados

35.840CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.458Referência 22.600GitHub PoC 14.323VulnCheck XDB 8.722Nuclei 4.320Metasploit 3.477✓ só verificadosrecentes populares risco

22.600 exploits

Referência✓ VexDay Proof

ScriptsFeed (SF) Auto Classifieds Software - Arbitrary File Upload

CVE-2008-6944—webappsphp

Unrestricted file upload vulnerability in ScriptsFeed Auto Classifieds allows remote authenticated users to execute arbi

23RISCO

abrir ↗

Referência

CVE-2009-4578

CVE-2009-4578—

Cross-site scripting (XSS) vulnerability in the Facileforms (com_facileforms) component for Joomla! and Mambo allows rem

23RISCO

abrir ↗

Referência

Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE

CVE-2025-1097HIGHremotemultiple

ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation

68RISCO

abrir ↗

Referência

CVE-2011-0885

CVE-2011-0885—

A certain Comcast Business Gateway configuration of the SMC SMCD3G-CCR with firmware before 1.4.0.49.2 has a default pas

28RISCO

abrir ↗

Referência

Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE

CVE-2025-1098HIGHremotemultiple

ingress-nginx controller - configuration injection via unsanitized mirror annotations

78RISCO

abrir ↗

Referência

CVE-2025-14558

CVE-2025-14558HIGH

Remote code execution via ND6 Router Advertisements

56RISCO

abrir ↗

Referência

CVE-2026-12183

CVE-2026-12183CRITICAL

Nefteprodukttekhnika BUK TS-G Gas Station Automation System Authentication Bypass via ajax-login.php Accepting Arbitrary Credentials

48RISCO

abrir ↗

Referência

CVE-2026-12066

CVE-2026-12066MEDIUM

PbootCMS Password MemberController.php retrieve password recovery

33RISCO

abrir ↗

Referência✓ VexDay Proof

AJ Article 1.0 - Remote Authentication Bypass

CVE-2008-7051—webappsphp

AJ Square AJ Article allows remote attackers to bypass authentication and access administrator functionality via a direc

23RISCO

abrir ↗

Referência

CVE-2026-8589

CVE-2026-8589HIGH

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

41RISCO

abrir ↗

Referência✓ VexDay Proof

Pre Real Estate Listings - Arbitrary File Upload

CVE-2008-7052—webappsphp

Unrestricted file upload vulnerability in profile.php in Pre Projects Pre Real Estate Listings allows remote authenticat

23RISCO

abrir ↗

Referência

CVE-2026-25860

CVE-2026-25860MEDIUM

OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler

33RISCO

abrir ↗

Referência

CVE-2026-25860 POC git

CVE-2026-25860MEDIUM

OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler

33RISCO

abrir ↗

Referência

CVE-2026-34417

CVE-2026-34417MEDIUM

OSCAL-GUI Reflected XSS via project parameter in oscal-forms.php

33RISCO

abrir ↗

Referência

CVE-2026-34416

CVE-2026-34416MEDIUM

OSCAL-GUI Reflected XSS via project parameter in oscal.php

33RISCO

abrir ↗

Referência

CVE-2025-55651

CVE-2025-55651MEDIUM

A NULL pointer dereference in the gf_isom_get_user_data_count function (isomedia/isom_read.c) of GPAC MP4Box v2.4 allows

33RISCO

abrir ↗

Referência

CVE-2026-11582

CVE-2026-11582MEDIUM

CodeAstro Student Attendance Management System index.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-11559

CVE-2026-11559MEDIUM

CodeAstro Payroll System view_account.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-25555

CVE-2026-25555CRITICAL

OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header

63RISCO

abrir ↗

Referência

CVE-2011-1092

CVE-2011-1092—

Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial of servic

28RISCO

abrir ↗

Referência✓ VexDay Proof

Nero ShowTime 5.0.15.0 - '.m3u' Playlist File Remote Buffer Overflow (PoC)

CVE-2008-7079—doswindows

Buffer overflow in Nero ShowTime 5.0.15.0 allows remote attackers to cause a denial of service (crash) and possibly exec

23RISCO

abrir ↗

Referência✓ VexDay Proof

ReVou Twitter Clone - Authentication Bypass

CVE-2008-7083—webappsphp

Multiple SQL injection vulnerabilities in ReVou Micro Blogging Twitter clone allow remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência✓ VexDay Proof

HockeySTATS Online 2.0 - Multiple SQL Injections

CVE-2008-7085—webappsphp

Multiple SQL injection vulnerabilities in TheHockeyStop HockeySTATS Online 2.0 Basic and Advanced allow remote attackers

23RISCO

abrir ↗

Referência✓ VexDay Proof

Maian Greetings 2.1 - Insecure Cookie Handling

CVE-2008-7086—webappsphp

Maian Greetings 2.1 allows remote attackers to bypass authentication and gain administrative privileges by setting the m

23RISCO

abrir ↗

Referência✓ VexDay Proof

PhotoPost vBGallery 2.4.2 - Arbitrary File Upload

CVE-2008-7088—webappsphp

Unrestricted file upload vulnerability in upload.php in PhotoPost vBGallery 2.4.2 allows remote authenticated users to e

23RISCO

abrir ↗

Referência✓ VexDay Proof

Pligg CMS 9.9.0 - Cross-Site Scripting / Local File Inclusion / SQL Injection

CVE-2008-7090—webappsphp

Multiple directory traversal vulnerabilities in Pligg 9.9 and earlier allow remote attackers to (1) determine the existe

23RISCO

abrir ↗

Referência✓ VexDay Proof

Pligg CMS 9.9.0 - Cross-Site Scripting / Local File Inclusion / SQL Injection

CVE-2008-7091—webappsphp

Multiple SQL injection vulnerabilities in Pligg 9.9 and earlier allow remote attackers to execute arbitrary SQL commands

23RISCO

abrir ↗

Referência

CVE-2011-1556

CVE-2011-1556—

SQL injection vulnerability in plugins/pdfClasses/pdfgen.php in Andy's PHP Knowledgebase (Aphpkb) 0.95.4 allows remote a

23RISCO

abrir ↗

Referência

CVE-2011-1565

CVE-2011-1565—

Directory traversal vulnerability in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphica

50RISCO

abrir ↗

Referência

CVE-2011-1670

CVE-2011-1670—

Cross-site scripting (XSS) vulnerability in actions/add.php in InTerra Blog Machine 1.84, and possibly earlier versions,

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.