Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

78.295exploits catalogados

36.048CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.458Referência 22.721GitHub PoC 14.464VulnCheck XDB 8.813Nuclei 4.350Metasploit 3.489✓ só verificadosrecentes populares risco

22.697 exploits

Referência✓ VexDay Proof

User Engine Lite ASP - 'users.mdb' Database Disclosure

CVE-2008-5601—webappsphp

User Engine Lite ASP stores sensitive information under the web root with insufficient access control, which allows remo

23RISCO

abrir ↗

Referência

CVE-2026-18787

CVE-2026-18787HIGH

GL.iNet AX1800 RPC Endpoint oui-rpc.lua remove_rule command injection

41RISCO

abrir ↗

Referência

CVE-2026-18785

CVE-2026-18785MEDIUM

o6 open62541 client_types_custom.c UA_Client_getRemoteDataTypes use after free

33RISCO

abrir ↗

Referência

CVE-2026-18784

CVE-2026-18784MEDIUM

o6 open62541 ua_client_highlevel.c UA_Client_readNodeClassAttribute heap-based overflow

33RISCO

abrir ↗

Referência✓ VexDay Proof

Natterchat 1.12 - Database Disclosure

CVE-2008-5602—webappsasp

Natterchat 1.12 stores sensitive information under the web root with insufficient access control, which allows remote at

23RISCO

abrir ↗

Referência✓ VexDay Proof

ASPTicker 1.0 - Remote Database Disclosure

CVE-2008-5603—webappsasp

ASPTicker 1.0 stores sensitive information under the web root with insufficient access control, which allows remote atta

23RISCO

abrir ↗

Referência

CVE-2026-14229

CVE-2026-14229MEDIUM

ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload

33RISCO

abrir ↗

Referência

CVE-2026-19845

CVE-2026-19845HIGH

TOTOLINK A800R lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow

41RISCO

abrir ↗

Referência

CVE-2026-19844

CVE-2026-19844HIGH

TOTOLINK A800R ipv6.so cstecgi.cgi setRadvdCfg stack-based overflow

41RISCO

abrir ↗

Referência

CVE-2026-32847

CVE-2026-32847HIGH

DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py

21RISCO

abrir ↗

Referência

CVE-2013-5316

CVE-2013-5316—

Cross-site request forgery (CSRF) vulnerability in RiteCMS 1.0.0 allows remote attackers to hijack the authentication of

23RISCO

abrir ↗

Referência

CVE-2010-3483

CVE-2010-3483—

cms_write.php in Primitive CMS 1.0.9 does not properly restrict access, which allows remote attackers to gain administra

23RISCO

abrir ↗

Referência

CVE-2017-17870

CVE-2017-17870—

The JBuildozer extension 1.4.1 for Joomla! has SQL Injection via the appid parameter in an entriessearch action.

23RISCO

abrir ↗

Referência

CVE-2026-18200

CVE-2026-18200MEDIUM

FoodBoxBooker < 1.0.8 - Subscriber+ Arbitrary User Profile Update

33RISCO

abrir ↗

Referência

CVE-2026-15047

CVE-2026-15047MEDIUM

s2Member < 260805 - Contributor+ Stored XSS via Shortcode

33RISCO

abrir ↗

Referência

CVE-2026-14293

CVE-2026-14293HIGH

Autopay / Blue Media for WooCommerce < 5.0.1 - Unauthenticated Stored XSS via CSS Editor

41RISCO

abrir ↗

Referência✓ VexDay Proof

Post Affiliate Pro 3 - 'umprof_status' Blind SQL Injection

CVE-2008-5630—webappsphp

SQL injection vulnerability in merchants/index.php in Post Affiliate Pro 3 and 3.1.4 allows remote attackers to execute

23RISCO

abrir ↗

Referência

CVE-2026-14238

CVE-2026-14238MEDIUM

Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report

33RISCO

abrir ↗

Referência

CVE-2026-69100

CVE-2026-69100HIGH

LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution

41RISCO

abrir ↗

Referência

CVE-2026-69098

CVE-2026-69098CRITICAL

kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization

48RISCO

abrir ↗

Referência

CVE-2026-18773

CVE-2026-18773MEDIUM

NousResearch hermes-agent Quick run.py _check_slash_access authorization

33RISCO

abrir ↗

Referência

CVE-2026-67199

CVE-2026-67199HIGH

Perspective 5.0.0 DoS via Loop Expression Evaluation

41RISCO

abrir ↗

Referência

CVE-2026-16548

CVE-2026-16548MEDIUM

Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response Endpoint

33RISCO

abrir ↗

Referência✓ VexDay Proof

Active Time Billing 3.2 - Authentication Bypass

CVE-2008-5632—webappsphp

SQL injection vulnerability in Account.asp in Active Time Billing 3.2 allows remote attackers to execute arbitrary SQL c

23RISCO

abrir ↗

Referência✓ VexDay Proof

Lito Lite CMS - 'cid' SQL Injection

CVE-2008-5636—webappsphp

SQL injection vulnerability in cate.php in Lito Lite CMS, when magic_quotes_gpc is disabled, allows remote attackers to

23RISCO

abrir ↗

Referência

CVE-2026-73514

CVE-2026-73514HIGH

PostGIS address_standardizer Out-of-Bounds Write via standardize_address()

41RISCO

abrir ↗

Referência

CVE-2026-14859

CVE-2026-14859MEDIUM

WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization

33RISCO

abrir ↗

Referência

CVE-2026-14858

CVE-2026-14858MEDIUM

WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR

33RISCO

abrir ↗

Referência

CVE-2026-14857

CVE-2026-14857MEDIUM

WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR

33RISCO

abrir ↗

Referência✓ VexDay Proof

Myiosoft EasyBookMarker 4 - 'Parent' SQL Injection

CVE-2008-5651—webappsphp

SQL injection vulnerability in plugins/bookmarker/bookmarker_backend.php in MyioSoft EasyBookMarker 4.0 allows remote at

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.