Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

78.137exploits catalogados

35.961CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.458Referência 22.657GitHub PoC 14.424VulnCheck XDB 8.773Nuclei 4.340Metasploit 3.485✓ só verificadosrecentes populares risco

22.657 exploits

Referência✓ VexDay Proof

Siteframe CMS 3.2.3 - 'folder.php' SQL Injection

CVE-2008-3256—webappsphp

SQL injection vulnerability in folder.php in Siteframe CMS 3.2.3 and earlier, and Siteframe Beaumont 5.0.5 and earlier,

23RISCO

abrir ↗

Referência

CVE-2021-47812

CVE-2021-47812CRITICAL

GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)

48RISCO

abrir ↗

Referência

CVE-2026-16650

CVE-2026-16650MEDIUM

Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass

33RISCO

abrir ↗

Referência

CVE-2017-16568

CVE-2017-16568—

Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality.

23RISCO

abrir ↗

Referência✓ VexDay Proof

cwmCounter 5.1.1 - 'statistic.php' Remote File Inclusion

CVE-2006-6738—webappsphp

PHP remote file inclusion vulnerability in statistic.php in cwmCounter 5.1.1 and earlier allows remote attackers to exec

23RISCO

abrir ↗

Referência✓ VexDay Proof

HIOX Browser Statistics 2.0 - Remote File Inclusion

CVE-2008-3402—webappsphp

Multiple PHP remote file inclusion vulnerabilities in HIOX Browser Statistics (HBS) 2.0 allow remote attackers to execut

23RISCO

abrir ↗

Referência✓ VexDay Proof

clickandemail - SQL Injection / Cross-Site Scripting

CVE-2008-5893—webappsasp

Cross-site scripting (XSS) vulnerability in admin_dblayers.asp in ClickAndEmail allows remote attackers to inject arbitr

23RISCO

abrir ↗

Referência✓ VexDay Proof

Simple Machines Forum (SMF) 1.1.6 - Code Execution

CVE-2008-6658—webappsphp

Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 all

23RISCO

abrir ↗

Referência✓ VexDay Proof

MGB 0.5.4.5 - 'email.php?id' SQL Injection

CVE-2007-0354—webappsphp

SQL injection vulnerability in email.php in MGB OpenSource Guestbook 0.5.4.5 and earlier allows remote attackers to exec

23RISCO

abrir ↗

Referência✓ VexDay Proof

Webyapar 2.0 - Multiple SQL Injections

CVE-2007-4068—webappsphp

Multiple SQL injection vulnerabilities in Webyapar 2.0 allow remote attackers to execute arbitrary SQL commands via (1)

23RISCO

abrir ↗

Referência

CVE-2009-2605

CVE-2009-2605—

Multiple SQL injection vulnerabilities in adminquery.php in Traidnt Up 2.0 allow remote attackers to execute arbitrary S

23RISCO

abrir ↗

Referência

CVE-2011-5197

CVE-2011-5197—

Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Harvester S

23RISCO

abrir ↗

Referência

CVE-2009-3218

CVE-2009-3218—

SQL injection vulnerability in control/login.php in AR Web Content Manager (AWCM) 2.1, when magic_quotes_gpc is disabled

23RISCO

abrir ↗

Referência

CVE-2026-9355

CVE-2026-9355MEDIUM

SourceCodester Hospitals Patient Records Management System Master.php save_patient_history sql injection

33RISCO

abrir ↗

Referência

CVE-2017-0122

CVE-2017-0122—

Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers

28RISCO

abrir ↗

Referência

CVE-2015-6396

CVE-2015-6396—

The CLI command parser on Cisco RV110W, RV130W, and RV215W devices allows local users to execute arbitrary shell command

23RISCO

abrir ↗

Referência

CVE-2019-17225

CVE-2019-17225—

Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" i

23RISCO

abrir ↗

Referência

CVE-2014-3778

CVE-2014-3778—

Multiple cross-site request forgery (CSRF) vulnerabilities in goform/RgDdns in ARRIS (formerly Motorola) SBG901 SURFboar

23RISCO

abrir ↗

Referência

CVE-2021-36654

CVE-2021-36654—

CMSuno 1.7 is vulnerable to an authenticated stored cross site scripting in modifying the filename parameter (tgo) while

23RISCO

abrir ↗

Referência✓ VexDay Proof

FlexPHPDirectory 0.0.1 - Authentication Bypass

CVE-2008-6749—webappsphp

Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPDirectory 0.0.1, when magic_quotes_gpc is disabl

23RISCO

abrir ↗

Referência✓ VexDay Proof

actSite 1.991 Beta - 'base.php' Remote File Inclusion

CVE-2007-5175—webappsphp

PHP remote file inclusion vulnerability lib/base.php in actSite 1.991 Beta allows remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência

CVE-2017-0123

CVE-2017-0123—

Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers

28RISCO

abrir ↗

Referência

CVE-2026-77020

CVE-2026-77020MEDIUM

CodeAstro Apartment Visitor Management System password-recovery.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-76998

CVE-2026-76998MEDIUM

SourceCodester Simple Online Food Ordering System ajax.php delete_category sql injection

33RISCO

abrir ↗

Referência

CVE-2026-76997

CVE-2026-76997MEDIUM

SourceCodester Simple Online Food Ordering System ajax.php save_category sql injection

33RISCO

abrir ↗

Referência

CVE-2008-6840

CVE-2008-6840—

Multiple PHP remote file inclusion vulnerabilities in V-webmail 1.6.4 allow remote attackers to execute arbitrary PHP co

23RISCO

abrir ↗

Referência

CVE-2017-20268

CVE-2017-20268HIGH

Joomla! Component Zap Calendar Lite 4.3.4 SQL Injection

41RISCO

abrir ↗

Referência✓ VexDay Proof

CoolPlayer 2.18 - '.m3u' File Local Buffer Overflow

CVE-2008-3408—localwindows

Stack-based buffer overflow in CoolPlayer 2.18, and possibly other versions, allows user-assisted remote attackers to ex

23RISCO

abrir ↗

Referência

CVE-2013-4863

CVE-2013-4863—

The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows (1) remote attackers to execute a

28RISCO

abrir ↗

Referência

CVE-2009-4800

CVE-2009-4800—

Directory traversal vulnerability in Sysax Multi Server 4.3 and 4.5 allows remote authenticated users to delete arbitrar

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.