Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

78.137exploits catalogados

35.961CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.458Referência 22.657GitHub PoC 14.424VulnCheck XDB 8.773Nuclei 4.340Metasploit 3.485✓ só verificadosrecentes populares risco

22.657 exploits

Referência

CVE-2015-4119

CVE-2015-4119—

Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijac

23RISCO

abrir ↗

Referência

CVE-2026-4252

CVE-2026-4252CRITICAL

Tenda AC8 IPv6 check_is_ipv6 ip address for authentication

48RISCO

abrir ↗

Referência✓ VexDay Proof

iG Calendar 1.0 - 'user.php?id' SQL Injection

CVE-2007-0130—webappsphp

SQL injection vulnerability in user.php in iGeneric iG Calendar 1.0 allows remote attackers to execute arbitrary SQL com

23RISCO

abrir ↗

Referência

CVE-2020-2038

CVE-2020-2038HIGH

PAN-OS: OS command injection vulnerability in the management web interface

78RISCO

abrir ↗

Referência

CVE-2026-17017

CVE-2026-17017HIGH

CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation

41RISCO

abrir ↗

Referência✓ VexDay Proof

FlexBB 0.5.5 - '/inc/start.php?_COOKIE' SQL Bypass

CVE-2006-1978—webappsphp

SQL injection vulnerability in inc/start.php in FlexBB 0.5.5 and earlier allows remote attackers to execute arbitrary SQ

23RISCO

abrir ↗

Referência✓ VexDay Proof

Okul Web Otomasyon Sistemi 4.0.1 - SQL Injection

CVE-2007-0305—webappsasp

SQL injection vulnerability in etkinlikbak.asp in Okul Web Otomasyon Sistemi 4.0.1 allows remote attackers to execute ar

23RISCO

abrir ↗

Referência✓ VexDay Proof

FreeBSD mcweject 0.9 'Eject' - Local Buffer Overflow / Local Privilege Escalation

CVE-2007-1719—localbsd

Buffer overflow in eject.c in Jason W. Bacon mcweject 0.9 on FreeBSD, and possibly other versions, allows local users to

23RISCO

abrir ↗

Referência✓ VexDay Proof

wolioCMS - Authentication Bypass / SQL Injection

CVE-2007-4156—webappsphp

Multiple SQL injection vulnerabilities in wolioCMS allow remote attackers to execute arbitrary SQL commands via (1) the

23RISCO

abrir ↗

Referência

CVE-2009-4567

CVE-2009-4567—

Multiple cross-site scripting (XSS) vulnerabilities in editprofile.php in Viscacha 0.8 Gold allow remote authenticated u

23RISCO

abrir ↗

Referência

CVE-2009-4567

CVE-2009-4567—

Multiple cross-site scripting (XSS) vulnerabilities in editprofile.php in Viscacha 0.8 Gold allow remote authenticated u

23RISCO

abrir ↗

Referência

CVE-2008-5689

CVE-2008-5689—

tun in IP Tunnel in Solaris 10 and OpenSolaris snv_01 through snv_76 allows local users to cause a denial of service (pa

23RISCO

abrir ↗

Referência

CVE-2010-2609

CVE-2010-2609—

SQL injection vulnerability in show_search_result.php in 2daybiz Job Search Engine Script allows remote attackers to exe

23RISCO

abrir ↗

Referência

CVE-2010-2609

CVE-2010-2609—

SQL injection vulnerability in show_search_result.php in 2daybiz Job Search Engine Script allows remote attackers to exe

23RISCO

abrir ↗

Referência

CVE-2026-8081

CVE-2026-8081MEDIUM

router-for-me CLIProxyAPI api_tools.go server-side request forgery

33RISCO

abrir ↗

Referência

CVE-2026-7414

CVE-2026-7414CRITICAL

Hardcoded credentials in Yarbo robot firmware

48RISCO

abrir ↗

Referência

CVE-2026-7413

CVE-2026-7413HIGH

Persistent undocumented backdoor access in Yarbo robot

41RISCO

abrir ↗

Referência✓ VexDay Proof

AdaptCMS Lite 1.3 - Blind SQL Injection

CVE-2008-4524—webappsphp

SQL injection vulnerability in the "Check User" feature (includes/check_user.php) in AdaptCMS Lite and AdaptCMS Pro 1.3

23RISCO

abrir ↗

Referência

CVE-2012-4240

CVE-2012-4240—

SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authentic

23RISCO

abrir ↗

Referência

CVE-2009-3348

CVE-2009-3348—

Cross-site scripting (XSS) vulnerability in Datavore Gyro 5.0 allows remote attackers to inject arbitrary web script or

23RISCO

abrir ↗

Referência

CVE-2018-4863

CVE-2018-4863—

Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection mechanism by deleting the HKE

23RISCO

abrir ↗

Referência

CVE-2009-3755

CVE-2009-3755—

Multiple cross-site scripting (XSS) vulnerabilities in phpBMS 0.96 allow remote attackers to inject arbitrary web script

23RISCO

abrir ↗

Referência✓ VexDay Proof

phpDatingClub 3.7 - SQL Injection / Cross-Site Scripting Injection

CVE-2009-2178—webappsphp

Cross-site scripting (XSS) vulnerability in website.php in phpDatingClub 3.7 allows remote attackers to inject arbitrary

23RISCO

abrir ↗

Referência

CVE-2010-2611

CVE-2010-2611—

SQL injection vulnerability in show_search_result.php in i-netsolution Job Search Engine allows remote attackers to exec

23RISCO

abrir ↗

Referência✓ VexDay Proof

DZCP (deV!L_z Clanportal) 1.34 - 'id' SQL Injection

CVE-2006-3347—webappsphp

SQL injection vulnerability in index.php in deV!Lz Clanportal DZCP 1.3.4 allows remote attackers to execute arbitrary SQ

23RISCO

abrir ↗

Referência✓ VexDay Proof

OpenLD 1.2.2 - 'index.php?id' SQL Injection

CVE-2007-3682—webappsphp

SQL injection vulnerability in index.php in OpenLD 1.2.2 and earlier allows remote attackers to execute arbitrary SQL co

23RISCO

abrir ↗

Referência

CVE-2020-23522

CVE-2020-23522—

Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data [Password] parameter.

23RISCO

abrir ↗

Referência

Tailor MS 1.0 - Reflected Cross-Site Scripting

CVE-2020-23835MEDIUMwebappsphp

A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Tailor Mana

33RISCO

abrir ↗

Referência

CVE-2010-4861

CVE-2010-4861—

SQL injection vulnerability in asearch.php in webSPELL 4.2.1 allows remote attackers to execute arbitrary SQL commands v

23RISCO

abrir ↗

Referência

CVE-2026-16589

CVE-2026-16589HIGH

WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter

41RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.