Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

78.137exploits catalogados

35.961CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.458Referência 22.657GitHub PoC 14.424VulnCheck XDB 8.773Nuclei 4.340Metasploit 3.485✓ só verificadosrecentes populares risco

22.657 exploits

Referência

CVE-2026-10249

CVE-2026-10249MEDIUM

itsourcecode Online Blood Bank Management System viewrequest.php sql injection

33RISCO

abrir ↗

Referência

CVE-2013-2680

CVE-2013-2680—

Cisco Linksys E4200 1.0.05 Build 7 devices store passwords in cleartext allowing remote attackers to obtain sensitive in

23RISCO

abrir ↗

Referência

CVE-2026-16735

CVE-2026-16735MEDIUM

release-it conventional-changelog Changelog File index.js writeChangelog os command injection

33RISCO

abrir ↗

Referência

CVE-2021-27308

CVE-2021-27308—

A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to in

23RISCO

abrir ↗

Referência

CVE-2026-63080

CVE-2026-63080HIGH

Aptabase SQL Injection via ClickHouse query backend

41RISCO

abrir ↗

Referência

CVE-2026-12592

CVE-2026-12592HIGH

SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header

41RISCO

abrir ↗

Referência✓ VexDay Proof

HIOX Banner Rotator 1.3 - 'hm' Remote File Inclusion

CVE-2008-3127—webappsphp

PHP remote file inclusion vulnerability in hioxBannerRotate.php in HIOX Banner Rotator (HBR) 1.3, when register_globals

23RISCO

abrir ↗

Referência

CVE-2026-16217

CVE-2026-16217MEDIUM

guohongze adminset Delivery Deployment Endpoint deli.py authorization

33RISCO

abrir ↗

Referência

CVE-2026-16216

CVE-2026-16216MEDIUM

geex-arts django-jet OAuth cross-site request forgery

33RISCO

abrir ↗

Referência

CVE-2026-16211

CVE-2026-16211LOW

allegro Hostname Allocation assets.py AssetLastHostname.increment_hostname race condition

28RISCO

abrir ↗

Referência

CVE-2026-16210

CVE-2026-16210MEDIUM

newpanjing simpleui AjaxAdmin AJAX Endpoint admin.py self.get_action missing authentication

33RISCO

abrir ↗

Referência

CVE-2017-17627

CVE-2017-17627—

Readymade Video Sharing Script 3.2 has SQL Injection via the single-video-detail.php report_videos array parameter.

23RISCO

abrir ↗

Referência

CVE-2017-17627

CVE-2017-17627—

Readymade Video Sharing Script 3.2 has SQL Injection via the single-video-detail.php report_videos array parameter.

23RISCO

abrir ↗

Referência

CVE-2017-15970

CVE-2017-15970—

PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter.

23RISCO

abrir ↗

Referência

CVE-2017-15970

CVE-2017-15970—

PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter.

23RISCO

abrir ↗

Referência

CVE-2009-3171

CVE-2009-3171—

Multiple cross-site scripting (XSS) vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to

23RISCO

abrir ↗

Referência

CVE-2012-2629

CVE-2012-2629—

Multiple cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities in Axous 1.1.1 and earlier all

23RISCO

abrir ↗

Referência

CVE-2012-2629

CVE-2012-2629—

Multiple cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities in Axous 1.1.1 and earlier all

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component BibTeX 1.3 - Blind SQL Injection

CVE-2007-4502—webappsphp

SQL injection vulnerability in index.php in the BibTeX component (com_jombib) 1.3 and earlier for Joomla! allows remote

23RISCO

abrir ↗

Referência

CVE-2009-3545

CVE-2009-3545—

DataWizard Technologies FtpXQ FTP Server 3.0 allows remote authenticated users to cause a denial of service (crash) via

23RISCO

abrir ↗

Referência

CVE-2021-33353

CVE-2021-33353CRITICAL

Directory Traversal vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows at

48RISCO

abrir ↗

Referência

CVE-2007-6191

CVE-2007-6191—

Multiple PHP remote file inclusion vulnerabilities in Armin Burger p.mapper 3.2.0 beta3 allow remote attackers to execut

23RISCO

abrir ↗

Referência

CVE-2012-1613

CVE-2012-1613—

Cross-site scripting (XSS) vulnerability in edit_one_pic.php in Coppermine Photo Gallery before 1.5.20 allows remote aut

23RISCO

abrir ↗

Referência

CVE-2012-1613

CVE-2012-1613—

Cross-site scripting (XSS) vulnerability in edit_one_pic.php in Coppermine Photo Gallery before 1.5.20 allows remote aut

23RISCO

abrir ↗

Referência

CVE-2017-16962

CVE-2017-16962—

The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities vi

23RISCO

abrir ↗

Referência

CVE-2017-16962

CVE-2017-16962—

The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities vi

23RISCO

abrir ↗

Referência

CVE-2011-4673

CVE-2011-4673—

SQL injection vulnerability in modules/sharedaddy.php in the Jetpack plugin for WordPress allows remote attackers to exe

23RISCO

abrir ↗

Referência

CVE-2026-10230

CVE-2026-10230MEDIUM

Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_animations heap-based overflow

33RISCO

abrir ↗

Referência

CVE-2019-7004

CVE-2019-7004MEDIUM

Avaya IP Office XSS Vulnerability

33RISCO

abrir ↗

Referência

CVE-2010-0665

CVE-2010-0665—

JAG (Just Another Guestbook) 1.14 stores sensitive information under the web root with insufficient access control, whic

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.