Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

78.258exploits catalogados

36.019CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.458Referência 22.697GitHub PoC 14.455VulnCheck XDB 8.811Nuclei 4.349Metasploit 3.488✓ só verificadosrecentes populares risco

22.657 exploits

Referência

CVE-2026-15260

CVE-2026-15260MEDIUM

Geo My WP < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR

33RISCO

abrir ↗

Referência

CVE-2026-15231

CVE-2026-15231LOW

TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR

28RISCO

abrir ↗

Referência

CVE-2026-12175

CVE-2026-12175MEDIUM

CodeAstro Student Attendance Management System createStudents.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-48558

CVE-2026-48558CRITICAL

SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

53RISCO

abrir ↗

Referência

CVE-2010-5056

CVE-2010-5056—

SQL injection vulnerability in the GBU Facebook (com_gbufacebook) component 1.0.5 for Joomla! allows remote attackers to

23RISCO

abrir ↗

Referência

CVE-2018-14575

CVE-2018-14575—

Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CS

23RISCO

abrir ↗

Referência✓ VexDay Proof

Web3news 0.95 - 'PHPSECURITYADMIN_PATH' Remote File Inclusion

CVE-2006-4452—webappsphp

PHP remote file inclusion vulnerability in security/include/_class.security.php in Web3news 0.95 and earlier, when regis

23RISCO

abrir ↗

Referência✓ VexDay Proof

XChat 2.6.7 (Windows) - Remote Denial of Service

CVE-2006-4455—doswindows

Unspecified vulnerability in Xchat 2.6.7 and earlier allows remote attackers to cause a denial of service (crash) via un

23RISCO

abrir ↗

Referência

CVE-2026-14557

CVE-2026-14557CRITICAL

SoftMarket <= 1.0.0 - Unauthenticated Account Takeover via Email Verification Bypass

48RISCO

abrir ↗

Referência

CVE-2026-15270

CVE-2026-15270HIGH

D-link DIR-823G Web boa.conf least privilege violation

41RISCO

abrir ↗

Referência

CVE-2026-60105

CVE-2026-60105HIGH

Monsta FTP < 2.14.5 SSRF via IPv4-Mapped IPv6 Address Bypass

41RISCO

abrir ↗

Referência

CVE-2026-10834

CVE-2026-10834MEDIUM

WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image

33RISCO

abrir ↗

Referência

CVE-2014-3974

CVE-2014-3974—

Cross-site scripting (XSS) vulnerability in filemanager.php in AuraCMS 3.0 and earlier allows remote attackers to inject

23RISCO

abrir ↗

Referência

CVE-2026-12065

CVE-2026-12065LOW

Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme

28RISCO

abrir ↗

Referência

CVE-2017-20250

CVE-2017-20250HIGH

WordPress Plugin Mac Photo Gallery 3.0 Arbitrary File Download

41RISCO

abrir ↗

Referência

CVE-2016-7089

CVE-2016-7089—

WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco

23RISCO

abrir ↗

Referência

CVE-2026-11502

CVE-2026-11502LOW

JeecgBoot Third-Party Login ThirdLoginController.java HttpServletResponse.sendRedirect redirect

28RISCO

abrir ↗

Referência

CVE-2026-11501

CVE-2026-11501MEDIUM

SourceCodester Hospitals Patient Records Management System Master.php save_patient sql injection

33RISCO

abrir ↗

Referência

CVE-2014-4033

CVE-2014-4033—

Cross-site scripting (XSS) vulnerability in libraries/includes/personal/profile.php in Epignosis eFront 3.6.14.4 allows

23RISCO

abrir ↗

Referência

CVE-2026-11337

CVE-2026-11337MEDIUM

tittuvarghese CollegeManagementSystem fetch.php cross site scripting

33RISCO

abrir ↗

Referência

CVE-2026-5655

CVE-2026-5655MEDIUM

Use After Free in Wireshark

33RISCO

abrir ↗

Referência

CVE-2016-7216

CVE-2016-7216—

The kernel API in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandles permissi

23RISCO

abrir ↗

Referência✓ VexDay Proof

Linksys SPA941 - Remote Reboot (Denial of Service)

CVE-2007-2270—doshardware

The Linksys SPA941 VoIP Phone allows remote attackers to cause a denial of service (device reboot) via a 0377 (0xff) cha

23RISCO

abrir ↗

Referência

CVE-2016-7226

CVE-2016-7226—

Virtual Hard Disk Driver in Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly restrict access to

23RISCO

abrir ↗

Referência

CVE-2026-11335

CVE-2026-11335MEDIUM

tittuvarghese CollegeManagementSystem login-form.php session_start session fixiation

33RISCO

abrir ↗

Referência

CVE-2026-7686

CVE-2026-7686MEDIUM

eyeo Adblock Plus Legacy Premium Activation premium.preload.js postMessage access control

33RISCO

abrir ↗

Referência

CVE-2026-7685

CVE-2026-7685HIGH

Edimax BR-6208AC setWAN buffer overflow

41RISCO

abrir ↗

Referência

CVE-2026-7684

CVE-2026-7684HIGH

Edimax BR-6428nC setWAN buffer overflow

41RISCO

abrir ↗

Referência

CVE-2026-7681

CVE-2026-7681MEDIUM

jsbroks COCO Annotator Dataset API datasets.py authorization

33RISCO

abrir ↗

Referência

CVE-2026-7680

CVE-2026-7680MEDIUM

jsbroks COCO Annotator Data Endpoint datasets.py path traversal

33RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.