Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

78.794exploits catalogados

36.057CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.459Referência 22.721GitHub PoC 14.946VulnCheck XDB 8.829Nuclei 4.350Metasploit 3.489✓ só verificadosrecentes populares risco

22.721 exploits

Referência

CVE-2026-14647

CVE-2026-14647MEDIUM

onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds

33RISCO

abrir ↗

Referência

CVE-2026-58453

CVE-2026-58453CRITICAL

JAIOTlink C492A-W6 4.8.30.57701411 Hard-coded Credentials via anyka_ipc

48RISCO

abrir ↗

Referência

CVE-2026-13567

CVE-2026-13567MEDIUM

code-projects Online Music Site POST Request Feedback.php cross site scripting

33RISCO

abrir ↗

Referência

CVE-2026-40524

CVE-2026-40524HIGH

FrontAccounting < 2.4.20 SQL Injection via get_gl_transactions()

41RISCO

abrir ↗

Referência

CVE-2026-13561

CVE-2026-13561MEDIUM

Edimax EW-7478APC POST Request formiNICbasic os command injection

33RISCO

abrir ↗

Referência✓ VexDay Proof

osTicket 1.11 - Cross-Site Scripting / Local File Inclusion

CVE-2019-11537—webappsphp

In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.ph

23RISCO

abrir ↗

Referência

CVE-2019-1153

CVE-2019-1153MEDIUM

Microsoft Graphics Component Information Disclosure Vulnerability

33RISCO

abrir ↗

Referência

CVE-2019-11539

CVE-2019-11539HIGHsob ataqueransomware

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1R

100RISCO

abrir ↗

Referência

CVE-2026-13549

CVE-2026-13549MEDIUM

CodeAstro Complaint Management System Report Endpoint Report.php deletereport authorization

33RISCO

abrir ↗

Referência

CVE-2026-5484

CVE-2026-5484MEDIUM

BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control

33RISCO

abrir ↗

Referência

CVE-2026-5323

CVE-2026-5323MEDIUM

priyankark a11y-mcp index.js A11yServer server-side request forgery

33RISCO

abrir ↗

Referência

CVE-2026-1540

CVE-2026-1540HIGH

Spam Protect for Contact Form 7 < 1.2.10 - Editor+ Remote Code Execution

41RISCO

abrir ↗

Referência

CVE-2026-5322

CVE-2026-5322MEDIUM

AlejandroArciniegas mcp-data-vis MCP server.js request sql injection

33RISCO

abrir ↗

Referência

CVE-2026-5321

CVE-2026-5321MEDIUM

vanna-ai vanna FastAPI/Flask Server cross-domain policy

33RISCO

abrir ↗

Referência

CVE-2026-5320

CVE-2026-5320MEDIUM

vanna-ai vanna Chat API Endpoint v2 missing authentication

33RISCO

abrir ↗

Referência

CVE-2026-5319

CVE-2026-5319MEDIUM

itsourcecode Payroll Management System navbar.php cross site scripting

33RISCO

abrir ↗

Referência

CVE-2026-5318

CVE-2026-5318MEDIUM

LibRaw JPEG DHT losslessjpeg.cpp initval out-of-bounds write

33RISCO

abrir ↗

Referência

CVE-2026-5317

CVE-2026-5317MEDIUM

Nothings stb stb_vorbis.c start_decoder out-of-bounds write

33RISCO

abrir ↗

Referência

CVE-2026-1879

CVE-2026-1879MEDIUM

Harvard University IQSS Dataverse Theme Customization ThemeAndWidgets.xhtml unrestricted upload

33RISCO

abrir ↗

Referência

CVE-2026-5261

CVE-2026-5261MEDIUM

Shandong Hoteam InforCenter PLM BaseHandler.ashx uploadFileToIIS unrestricted upload

33RISCO

abrir ↗

Referência

CVE-2025-15484

CVE-2025-15484CRITICAL

Order Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission Bypass

48RISCO

abrir ↗

Referência

CVE-2026-5255

CVE-2026-5255MEDIUM

code-projects Simple Laundry System Parameter delstaffinfo.php cross site scripting

33RISCO

abrir ↗

Referência

CVE-2026-5254

CVE-2026-5254MEDIUM

welovemedia FFmate Webhook AppJsonTreeView.vue cross site scripting

33RISCO

abrir ↗

Referência

CVE-2026-5253

CVE-2026-5253MEDIUM

bufanyun HotGo editNotice Endpoint MessageList.vue cross site scripting

33RISCO

abrir ↗

Referência

CVE-2026-5252

CVE-2026-5252MEDIUM

z-9527 admin Message Create Endpoint message.js cross site scripting

33RISCO

abrir ↗

Referência

CVE-2026-5251

CVE-2026-5251MEDIUM

z-9527 admin User Update Endpoint user.js dynamically-determined object attributes

33RISCO

abrir ↗

Referência

CVE-2026-5249

CVE-2026-5249MEDIUM

gougucms Record Endpoint record.html cross site scripting

33RISCO

abrir ↗

Referência

CVE-2026-5248

CVE-2026-5248MEDIUM

gougucms User Registration Login.php reg_submit dynamically-determined object attributes

33RISCO

abrir ↗

Referência

CVE-2026-35057

CVE-2026-35057MEDIUM

XenForo Stored Cross-Site Scripting via Structured Text Mentions

33RISCO

abrir ↗

Referência

CVE-2026-79845

CVE-2026-79845MEDIUM

code-projects Simple Inventory System edit.php sql injection

33RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.