Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

78.794exploits catalogados

36.057CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.459Referência 22.721GitHub PoC 14.946VulnCheck XDB 8.829Nuclei 4.350Metasploit 3.489✓ só verificadosrecentes populares risco

22.721 exploits

Referência

CVE-2014-8998

CVE-2014-8998—

lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a c

50RISCO

abrir ↗

Referência

CVE-2014-8998

CVE-2014-8998—

lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a c

50RISCO

abrir ↗

Referência

CVE-2026-18960

CVE-2026-18960MEDIUM

Block User Account < 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords

33RISCO

abrir ↗

Referência

CVE-2026-18946

CVE-2026-18946HIGH

Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename

41RISCO

abrir ↗

Referência

CVE-2026-9515

CVE-2026-9515MEDIUM

Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injection

38RISCO

abrir ↗

Referência

CVE-2026-9514

CVE-2026-9514MEDIUM

Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injection

38RISCO

abrir ↗

Referência

CVE-2026-13701

CVE-2026-13701MEDIUM

Advanced Excerpt < 4.5 - Admin+ Stored XSS via Ellipsis Setting

33RISCO

abrir ↗

Referência

CVE-2026-17540

CVE-2026-17540HIGH

Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch

41RISCO

abrir ↗

Referência

CVE-2026-19382

CVE-2026-19382MEDIUM

Almico Speedfan MSR Index speedfan.sys KiSystemCall64 memory leak

33RISCO

abrir ↗

Referência

CVE-2026-19380

CVE-2026-19380MEDIUM

Mullvad wireguard.sys IOCTL AdapterState reference count

33RISCO

abrir ↗

Referência

CVE-2026-19345

CVE-2026-19345MEDIUM

code-projects Task Management System UpdateTaskStatus.php authorization

33RISCO

abrir ↗

Referência

CVE-2011-4809

CVE-2011-4809—

Multiple cross-site scripting (XSS) vulnerabilities in the HM Community (com_hmcommunity) component before 1.01 for Joom

23RISCO

abrir ↗

Referência

CVE-2026-16265

CVE-2026-16265MEDIUM

WP Maps < 4.9.7 - Subscriber+ Denial of Service

33RISCO

abrir ↗

Referência

CVE-2026-9475

CVE-2026-9475CRITICAL

Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection

48RISCO

abrir ↗

Referência

CVE-2014-7222

CVE-2014-7222—

Buffer overflow in TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (a

23RISCO

abrir ↗

Referência✓ VexDay Proof

Multiple Membership Script 2.5 - 'id' SQL Injection

CVE-2008-6362—webappsphp

SQL injection vulnerability in sitepage.php in Multiple Membership Script 2.5 allows remote attackers to execute arbitra

23RISCO

abrir ↗

Referência

CVE-2026-9474

CVE-2026-9474MEDIUM

yashpokharna2555 StudentManagementSystem studentdel.php confirm_logged_in sql injection

33RISCO

abrir ↗

Referência

CVE-2026-9473

CVE-2026-9473MEDIUM

c-rick jimeng-mcp api.ts generateVideo path traversal

33RISCO

abrir ↗

Referência

CVE-2014-9418

CVE-2014-9418—

The eSpace Meeting ActiveX control (eSpaceStatusCtrl.dll) in Huawei eSpace Desktop before V200R001C03 allows local users

23RISCO

abrir ↗

Referência✓ VexDay Proof

Softerra PHP Developer Library 1.5.3 - Remote File Inclusion

CVE-2006-5472—webappsphp

PHP remote file inclusion vulnerability in Softerra PHP Developer Library 1.5.3 and earlier allows remote attackers to e

23RISCO

abrir ↗

Referência

CVE-2026-41949

CVE-2026-41949HIGH

Dify < 1.14.2 Authorization Bypass via File Preview Endpoint

41RISCO

abrir ↗

Referência✓ VexDay Proof

CASTOR 1.1.1 - '/lib/rs.php' Remote File Inclusion

CVE-2006-5480—webappsphp

PHP remote file inclusion vulnerability in lib/rs.php in 2le.net Castor PHP Web Builder 1.1.1 allows remote attackers to

23RISCO

abrir ↗

Referência✓ VexDay Proof

CCProxy 6.2 - 'ping' Remote Buffer Overflow

CVE-2004-2685—remotewindows

Buffer overflow in YoungZSoft CCProxy 6.2 and earlier allows remote attackers to execute arbitrary code via a long addre

28RISCO

abrir ↗

Referência✓ VexDay Proof

CCProxy 6.2 - Telnet Proxy Ping Overflow (Metasploit)

CVE-2004-2685—remotewindows

Buffer overflow in YoungZSoft CCProxy 6.2 and earlier allows remote attackers to execute arbitrary code via a long addre

28RISCO

abrir ↗

Referência✓ VexDay Proof

DigitalHive 2.0 RC2 - 'base_include.php' Remote File Inclusion

CVE-2006-5493—webappsphp

PHP remote file inclusion vulnerability in template/purpletech/base_include.php in DigitalHive 2.0 RC2 allows remote att

23RISCO

abrir ↗

Referência✓ VexDay Proof

pandaBB - 'displayCategory' Remote File Inclusion

CVE-2006-5494—webappsphp

Multiple PHP remote file inclusion vulnerabilities in modules/My_eGallery/public/displayCategory.php in the pandaBB modu

23RISCO

abrir ↗

Referência

CVE-2026-16565

CVE-2026-16565MEDIUM

Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API

33RISCO

abrir ↗

Referência

CVE-2026-16564

CVE-2026-16564MEDIUM

Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint

33RISCO

abrir ↗

Referência

CVE-2026-16563

CVE-2026-16563MEDIUM

Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint

33RISCO

abrir ↗

Referência

CVE-2026-16539

CVE-2026-16539HIGH

SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication

41RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.