Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.900exploits catalogados

35.840CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.458Referência 22.600GitHub PoC 14.323VulnCheck XDB 8.722Nuclei 4.320Metasploit 3.477✓ só verificadosrecentes populares risco

22.600 exploits

Referência

CVE-2010-0982

CVE-2010-0982—

Directory traversal vulnerability in the CARTwebERP (com_cartweberp) component 1.56.75 for Joomla! allows remote attacke

38RISCO

abrir ↗

Referência✓ VexDay Proof

FlashBB 1.1.8 - 'sendmsg.php' Remote File Inclusion

CVE-2007-3697—webappsphp

PHP remote file inclusion vulnerability in phpbb/sendmsg.php in FlashBB 1.1.8 and earlier allows remote attackers to exe

28RISCO

abrir ↗

Referência

CVE-2013-5092

CVE-2013-5092—

Cross-site scripting (XSS) vulnerability in afa/php/Login.php in AlgoSec Firewall Analyzer 6.1-b86 allows remote attacke

23RISCO

abrir ↗

Referência

CVE-2013-3538

CVE-2013-3538—

Multiple cross-site scripting (XSS) vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to injec

23RISCO

abrir ↗

Referência

CVE-2017-1002002

CVE-2017-1002002—

Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http:

23RISCO

abrir ↗

Referência

CVE-2014-100030

CVE-2014-100030—

Cross-site scripting (XSS) vulnerability in module/search/function.php in Ganesha Digital Library (GDL) 4.2 allows remot

23RISCO

abrir ↗

Referência

CVE-2023-2636

CVE-2023-2636—

AN_GradeBook <= 5.0.1 - Subscriber+ SQLi

23RISCO

abrir ↗

Referência

CVE-2023-2636

CVE-2023-2636—

AN_GradeBook <= 5.0.1 - Subscriber+ SQLi

23RISCO

abrir ↗

Referência

CVE-2018-9172

CVE-2018-9172—

The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes.

23RISCO

abrir ↗

Referência

CVE-2016-1609

CVE-2016-1609—

Multiple cross-site scripting (XSS) vulnerabilities in Novell Filr before 1.2 Security Update 3 and 2.0 before Security

23RISCO

abrir ↗

Referência

CVE-2011-4879

CVE-2011-4879—

miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA po

28RISCO

abrir ↗

Referência

CVE-2019-7541

CVE-2019-7541—

Rukovoditel through 2.4.1 allows XSS via a URL that lacks a module=users%2flogin substring.

23RISCO

abrir ↗

Referência

CVE-2019-7541

CVE-2019-7541—

Rukovoditel through 2.4.1 allows XSS via a URL that lacks a module=users%2flogin substring.

23RISCO

abrir ↗

Referência

CVE-2022-24082

CVE-2022-24082CRITICAL

If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Inte

53RISCO

abrir ↗

Referência

CVE-2018-7745

CVE-2018-7745—

An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/install/inst

28RISCO

abrir ↗

Referência

CVE-2016-6599

CVE-2016-6599—

BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService)

23RISCO

abrir ↗

Referência

CVE-2014-2072

CVE-2014-2072—

Dassault Systemes Catia V5-6R2013: Stack Buffer Overflow due to inadequate boundary checks

23RISCO

abrir ↗

Referência

CVE-2011-2505

CVE-2011-2505—

libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4

28RISCO

abrir ↗

Referência✓ VexDay Proof

Axiom Photo/News Gallery 0.8.6 - Remote File Inclusion

CVE-2007-0200—webappsphp

PHP remote file inclusion vulnerability in template.php in Geoffrey Golliher Axiom Photo/News Gallery (axiompng) 0.8.6 a

23RISCO

abrir ↗

Referência✓ VexDay Proof

GLLCTS2 - 'sort' Blind SQL Injection

CVE-2008-2919—webappsphp

SQL injection vulnerability in listing.php in Gryphon gllcTS2 4.2.4 allows remote attackers to execute arbitrary SQL com

23RISCO

abrir ↗

Referência✓ VexDay Proof

CoD2: DreamStats 4.2 - 'index.php' Remote File Inclusion

CVE-2007-0757—webappsphp

PHP remote file inclusion vulnerability in index.php in Miguel Nunes Call of Duty 2 (CoD2) DreamStats System 4.2 and ear

23RISCO

abrir ↗

Referência✓ VexDay Proof

AgerMenu 0.01 - 'top.inc.php?rootdir' Remote File Inclusion

CVE-2007-0837—webappsphp

PHP remote file inclusion vulnerability in examples/inc/top.inc.php in AgerMenu 0.03 and earlier allows remote attackers

23RISCO

abrir ↗

Referência

CVE-2015-7241

CVE-2015-7241—

XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.

23RISCO

abrir ↗

Referência

CVE-2015-3796

CVE-2015-3796—

The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute

28RISCO

abrir ↗

Referência

CVE-2016-0079

CVE-2016-0079—

The kernel in Microsoft Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application

23RISCO

abrir ↗

Referência

CVE-2010-1226

CVE-2010-1226—

The HTTP client functionality in Apple iPhone OS 3.1 on the iPhone 2G and 3.1.3 on the iPhone 3GS allows remote attacker

23RISCO

abrir ↗

Referência

CVE-2010-2129

CVE-2010-2129—

Directory traversal vulnerability in the JE Ajax Event Calendar (com_jeajaxeventcalendar) component 1.0.1 and 1.0.3 for

23RISCO

abrir ↗

Referência

CVE-2010-2129

CVE-2010-2129—

Directory traversal vulnerability in the JE Ajax Event Calendar (com_jeajaxeventcalendar) component 1.0.1 and 1.0.3 for

23RISCO

abrir ↗

Referência

CVE-2018-9163

CVE-2018-9163—

A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) all

23RISCO

abrir ↗

Referência

CVE-2023-1020

CVE-2023-1020CRITICAL

Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated SQLi

63RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.