Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

78.958exploits catalogados

36.206CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8.829Nuclei 4.357Metasploit 3.489✓ só verificadosrecentes populares risco

22.721 exploits

Referência✓ VexDay Proof

BoatScripts Classifieds - 'type' SQL Injection

CVE-2008-2846—webappsphp

SQL injection vulnerability in index.php in BoatScripts Classifieds allows remote attackers to execute arbitrary SQL com

23RISCO

abrir ↗

Referência

CVE-2018-1122

CVE-2018-1122HIGH

procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset

41RISCO

abrir ↗

Referência✓ VexDay Proof

project alumni 1.0.9 - Cross-Site Scripting / SQL Injection

CVE-2007-6126—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to inject

23RISCO

abrir ↗

Referência✓ VexDay Proof

WorkingOnWeb 2.0.1400 - 'events.php' SQL Injection

CVE-2007-6128—webappsphp

SQL injection vulnerability in events.php in WorkingOnWeb 2.0.1400 allows remote attackers to execute arbitrary SQL comm

23RISCO

abrir ↗

Referência✓ VexDay Proof

Content Injector 1.52 - 'index.php?cat' SQL Injection

CVE-2007-6137—webappsphp

SQL injection vulnerability in news.php in Content Injector 1.52 allows remote attackers to execute arbitrary SQL comman

23RISCO

abrir ↗

Referência

CVE-2026-11998

CVE-2026-11998HIGH

AngularJS XSS via SCE resource URL sanitization bypass

41RISCO

abrir ↗

Referência

CVE-2026-11998

CVE-2026-11998HIGH

AngularJS XSS via SCE resource URL sanitization bypass

41RISCO

abrir ↗

Referência

CVE-2026-50128

CVE-2026-50128MEDIUM

Mastodon: Spoofing of attribution domains

33RISCO

abrir ↗

Referência

CVE-2026-8379

CVE-2026-8379HIGH

Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Download

41RISCO

abrir ↗

Referência

CVE-2026-7842

CVE-2026-7842MEDIUM

Infility Global < 2.15.20 - Editor+ SQL Injection via orderby Parameter

33RISCO

abrir ↗

Referência

CVE-2026-12823

CVE-2026-12823MEDIUM

Browserbase Skills Autobrowse Trace Artifact default permission

33RISCO

abrir ↗

Referência

CVE-2026-12814

CVE-2026-12814MEDIUM

Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection

33RISCO

abrir ↗

Referência

CVE-2026-12810

CVE-2026-12810MEDIUM

Edimax BR-6478AC V2 POST Request mp command injection

33RISCO

abrir ↗

Referência

CVE-2018-11776

CVE-2018-11776HIGHsob ataque

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN

100RISCO

abrir ↗

Referência

CVE-2018-11776

CVE-2018-11776HIGHsob ataque

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN

100RISCO

abrir ↗

Referência✓ VexDay Proof

Plogger 3.0 - SQL Injection

CVE-2008-3563—webappsphp

Multiple SQL injection vulnerabilities in Plogger 3.0 and earlier allow remote attackers to execute arbitrary SQL comman

23RISCO

abrir ↗

Referência

CVE-2026-6324

CVE-2026-6324MEDIUM

Libsoup: libsoup: http request smuggling via unsigned to signed conversion error

33RISCO

abrir ↗

Referência

CVE-2026-9606

CVE-2026-9606MEDIUM

itsourcecode Courier Management System manage_user.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-9605

CVE-2026-9605MEDIUM

GNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based overflow

33RISCO

abrir ↗

Referência

CVE-2026-9512

CVE-2026-9512MEDIUM

Totolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injection

33RISCO

abrir ↗

Referência

CVE-2026-9511

CVE-2026-9511MEDIUM

Totolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injection

33RISCO

abrir ↗

Referência

CVE-2026-9498

CVE-2026-9498MEDIUM

Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine

33RISCO

abrir ↗

Referência

CVE-2018-5981

CVE-2018-5981—

SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter.

23RISCO

abrir ↗

Referência

CVE-2018-5982

CVE-2018-5982—

SQL Injection exists in the Advertisement Board 3.1.0 component for Joomla! via a task=show_rss_categories&catname= requ

23RISCO

abrir ↗

Referência

CVE-2026-44195

CVE-2026-44195MEDIUM

OPNsense: Authentication lockout bypass

33RISCO

abrir ↗

Referência

CVE-2026-73033

CVE-2026-73033HIGH

Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php

41RISCO

abrir ↗

Referência✓ VexDay Proof

IP Reg 0.4 - Multiple SQL Injections

CVE-2008-4606—webappsphp

Multiple SQL injection vulnerabilities in IP Reg 0.4 and earlier allow remote attackers to execute arbitrary SQL command

23RISCO

abrir ↗

Referência

CVE-2026-19089

CVE-2026-19089CRITICAL

Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload

48RISCO

abrir ↗

Referência

Joomla! Component JEXTN Membership 3.1.0 - 'usr_plan' SQL Injection

CVE-2018-6577—webappsphp

SQL Injection exists in the JEXTN Membership 3.1.0 component for Joomla! via the usr_plan parameter in a view=myplans&ta

23RISCO

abrir ↗

Referência✓ VexDay Proof

Eurologon CMS - 'files.php' Arbitrary File Download

CVE-2007-6185—webappsphp

Directory traversal vulnerability in users/files.php in Eurologon CMS allows remote attackers to read arbitrary files vi

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.