Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

78.137exploits catalogados

35.961CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.458Referência 22.657GitHub PoC 14.424VulnCheck XDB 8.773Nuclei 4.340Metasploit 3.485✓ só verificadosrecentes populares risco

22.657 exploits

Referência

CVE-2010-1343

CVE-2010-1343—

SQL injection vulnerability in photo.php in SiteX 0.7.4 beta allows remote attackers to execute arbitrary SQL commands v

23RISCO

abrir ↗

Referência

CVE-2013-10043

CVE-2013-10043CRITICAL

Astium VOIP PBX <= 2.1 SQL Injection File Upload RCE

63RISCO

abrir ↗

Referência

CVE-2013-10043

CVE-2013-10043CRITICAL

Astium VOIP PBX <= 2.1 SQL Injection File Upload RCE

63RISCO

abrir ↗

Referência

CVE-2015-6518

CVE-2015-6518—

Multiple cross-site scripting (XSS) vulnerabilities in phpLiteAdmin 1.1 allow remote attackers to inject arbitrary web s

23RISCO

abrir ↗

Referência✓ VexDay Proof

gCards 1.46 - SQL Injection / Remote Code Execution

CVE-2007-2971—webappsphp

SQL injection vulnerability in getnewsitem.php in gCards 1.46 and earlier allows remote attackers to execute arbitrary S

23RISCO

abrir ↗

Referência✓ VexDay Proof

Zanfi CMS lite 1.2 - Multiple Local File Inclusions

CVE-2008-4158—webappsphp

Multiple directory traversal vulnerabilities in index.php in Zanfi CMS lite 1.2 allow remote attackers to include and ex

23RISCO

abrir ↗

Referência✓ VexDay Proof

TurnkeyForms Text Link Sales - 'id' Cross-Site Scripting / SQL Injection

CVE-2008-5487—webappsphp

Cross-site scripting (XSS) vulnerability in admin.php in TurnkeyForms Text Link Sales allows remote attackers to inject

23RISCO

abrir ↗

Referência✓ VexDay Proof

myPHPscripts Login Session 2.0 - Cross-Site Scripting / Database Disclosure

CVE-2008-5854—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in login.php in myPHPscripts Login Session 2.0 allow remote attacker

23RISCO

abrir ↗

Referência✓ VexDay Proof

Flexphplink 0.0.x - Authentication Bypass

CVE-2008-6730—webappsphp

Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPLink Pro 0.0.6 and 0.0.7, when magic_quotes_gpc

23RISCO

abrir ↗

Referência✓ VexDay Proof

MindDezign Photo Gallery 2.2 - Arbitrary Add Admin

CVE-2008-6790—webappsphp

The admin module in MindDezign Photo Gallery 2.2 allows remote attackers to add administrative users and gain privileges

23RISCO

abrir ↗

Referência

CVE-2008-6840

CVE-2008-6840—

Multiple PHP remote file inclusion vulnerabilities in V-webmail 1.6.4 allow remote attackers to execute arbitrary PHP co

23RISCO

abrir ↗

Referência

CVE-2017-20268

CVE-2017-20268HIGH

Joomla! Component Zap Calendar Lite 4.3.4 SQL Injection

41RISCO

abrir ↗

Referência✓ VexDay Proof

CoolPlayer 2.18 - '.m3u' File Local Buffer Overflow

CVE-2008-3408—localwindows

Stack-based buffer overflow in CoolPlayer 2.18, and possibly other versions, allows user-assisted remote attackers to ex

23RISCO

abrir ↗

Referência

CVE-2013-4863

CVE-2013-4863—

The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows (1) remote attackers to execute a

28RISCO

abrir ↗

Referência

CVE-2009-4800

CVE-2009-4800—

Directory traversal vulnerability in Sysax Multi Server 4.3 and 4.5 allows remote authenticated users to delete arbitrar

23RISCO

abrir ↗

Referência

CVE-2026-8383

CVE-2026-8383MEDIUM

LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API

48RISCO

abrir ↗

Referência

CVE-2016-20075

CVE-2016-20075HIGH

WordPress Ultimate Product Catalog 3.8.6 Arbitrary File Upload RCE

41RISCO

abrir ↗

Referência

CVE-2016-20074

CVE-2016-20074MEDIUM

WordPress Lazy Content Slider Plugin 3.4 CSRF

33RISCO

abrir ↗

Referência

CVE-2026-12223

CVE-2026-12223MEDIUM

Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection

33RISCO

abrir ↗

Referência

CVE-2021-28420

CVE-2021-28420—

A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and th

23RISCO

abrir ↗

Referência

CVE-2023-7311

CVE-2023-7311CRITICAL

BYTEVALUE Intelligent Flow Control Router Command Injection

48RISCO

abrir ↗

Referência✓ VexDay Proof

Gradman 0.1.3 - 'info.php' Local File Inclusion

CVE-2008-0393—webappsphp

Directory traversal vulnerability in info.php in GradMan 0.1.3 and earlier allows remote attackers to include and execut

23RISCO

abrir ↗

Referência

CVE-2018-11502

CVE-2018-11502—

An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display t

23RISCO

abrir ↗

Referência

CVE-2014-5288

CVE-2014-5288—

A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages.

23RISCO

abrir ↗

Referência

CVE-2014-5288

CVE-2014-5288—

A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages.

23RISCO

abrir ↗

Referência

CVE-2013-7316

CVE-2013-7316—

Cross-site scripting (XSS) vulnerability in GitLab 6.0 and other versions before 6.5.0 allows remote attackers to inject

23RISCO

abrir ↗

Referência

CVE-2022-34668

CVE-2022-34668CRITICAL

NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage ma

48RISCO

abrir ↗

Referência

CVE-2013-5094

CVE-2013-5094—

Cross-site scripting (XSS) vulnerability in index.exp in McAfee Vulnerability Manager 7.5 allows remote attackers to inj

23RISCO

abrir ↗

Referência

CVE-2009-4543

CVE-2009-4543—

PHP remote file inclusion vulnerability in index.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote att

23RISCO

abrir ↗

Referência

CVE-2015-6639

CVE-2015-6639—

The Widevine QSEE TrustZone application in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.