Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

78.958exploits catalogados

36.206CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8.829Nuclei 4.357Metasploit 3.489✓ só verificadosrecentes populares risco

22.832 exploits

Referência✓ VexDay Proof

BulletProof FTP Client 2.63 - Local Heap Overflow (PoC)

CVE-2008-5753—doswindows

Stack-based buffer overflow in BulletProof FTP Client 2.63 and 2010 allows user-assisted attackers to execute arbitrary

23RISCO

abrir ↗

Referência

CVE-2018-13108

CVE-2018-13108—

All ADB broadband gateways / routers based on the Epicentro platform are affected by a local root jailbreak vulnerabilit

23RISCO

abrir ↗

Referência✓ VexDay Proof

TUTOS 1.3 - 'cmd.php' Remote Command Execution

CVE-2008-0149—webappsphp

TUTOS 1.3 allows remote attackers to read system information via a direct request to php/admin/phpinfo.php, which calls

23RISCO

abrir ↗

Referência✓ VexDay Proof

FlexBB 0.6.3 - Cookies SQL Injection

CVE-2008-0157—webappsphp

SQL injection vulnerability in FlexBB 0.6.3 and earlier allows remote attackers to execute arbitrary SQL commands via th

23RISCO

abrir ↗

Referência

CVE-2026-16009

CVE-2026-16009MEDIUM

itsourcecode Hospital Management System prescriptionorderdetail.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-12684

CVE-2026-12684MEDIUM

Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media

33RISCO

abrir ↗

Referência

CVE-2026-12585

CVE-2026-12585HIGH

Abandoned Cart Lite for WooCommerce < 6.8.2 - Unauthenticated Account Takeover via Malleable Recovery-Link Token

41RISCO

abrir ↗

Referência

CVE-2026-15520

CVE-2026-15520MEDIUM

GNU LibreDWG R2004 Section Decompression decode.c decompress_R2004_section heap-based overflow

33RISCO

abrir ↗

Referência

CVE-2026-15518

CVE-2026-15518MEDIUM

AREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted upload

33RISCO

abrir ↗

Referência

CVE-2026-12525

CVE-2026-12525HIGH

Redux Framework < 4.5.13 - Subscriber+ Privilege Escalation to Administrator

41RISCO

abrir ↗

Referência

CVE-2026-15523

CVE-2026-15523MEDIUM

CodeAstro Simple Online Leave Management System dashboard.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-15522

CVE-2026-15522MEDIUM

tugcantopaloglu godot-mcp run_project index.js validatePath path traversal

33RISCO

abrir ↗

Referência

CVE-2026-15521

CVE-2026-15521MEDIUM

makafeli n8n-workflow-builder update_node_from_file server.cjs path traversal

33RISCO

abrir ↗

Referência

CVE-2026-15517

CVE-2026-15517MEDIUM

Jinher OA PlanGiveOut.aspx sql injection

33RISCO

abrir ↗

Referência

CVE-2026-15516

CVE-2026-15516MEDIUM

MacCMS Pro Installation Index.php step5 authorization

33RISCO

abrir ↗

Referência

CVE-2026-15515

CVE-2026-15515HIGH

Tencent PC Manager QMUDisk Driver qmudisk64.sys uncontrolled search path

41RISCO

abrir ↗

Referência

CVE-2026-15473

CVE-2026-15473MEDIUM

Eleveo Call Recording Software Recorded Calls restoreCallAction.do improper authorization

33RISCO

abrir ↗

Referência

CVE-2018-13405

CVE-2018-13405—

The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an

23RISCO

abrir ↗

Referência

CVE-2026-15472

CVE-2026-15472MEDIUM

Eleveo Call Recording Software composeEmailAction.do improper authorization

33RISCO

abrir ↗

Referência

CVE-2026-12378

CVE-2026-12378HIGH

BookingPress <= 1.1.28 - Unauthenticated PHP Object Injection

41RISCO

abrir ↗

Referência

CVE-2025-15668

CVE-2025-15668MEDIUM

GPAC MP4Box box_code_base.c sgpd_del_entry heap-based overflow

33RISCO

abrir ↗

Referência

CVE-2025-15667

CVE-2025-15667MEDIUM

GPAC MP4Box avc_ext.c gf_isom_nalu_sample_rewrite double free

33RISCO

abrir ↗

Referência

CVE-2026-14713

CVE-2026-14713MEDIUM

SourceCodester Pizzafy E-Commerce System ajax.php confirm_order sql injection

33RISCO

abrir ↗

Referência

CVE-2026-14706

CVE-2026-14706MEDIUM

code-projects Online Examination Quiz Creation Feature update.php sql injection

33RISCO

abrir ↗

Referência✓ VexDay Proof

Binn SBuilder - 'nid' Blind SQL Injection

CVE-2008-0253—webappsphp

SQL injection vulnerability in full_text.php in Binn SBuilder allows remote attackers to execute arbitrary SQL commands

23RISCO

abrir ↗

Referência✓ VexDay Proof

TutorialCMS 1.02 - 'Username' SQL Injection

CVE-2008-0254—webappsphp

SQL injection vulnerability in activate.php in TutorialCMS (aka Photoshop Tutorials) 1.02, when magic_quotes_gpc is disa

23RISCO

abrir ↗

Referência

CVE-2026-6352

CVE-2026-6352LOW

Incorrect Authorization in GitLab

28RISCO

abrir ↗

Referência

CVE-2018-14058

CVE-2018-14058—

Pimcore before 5.3.0 allows SQL Injection via the REST web service API.

43RISCO

abrir ↗

Referência

CVE-2026-6896

CVE-2026-6896HIGH

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

41RISCO

abrir ↗

Referência

CVE-2026-58583

CVE-2026-58583HIGH

FluxInk Color Management Driver local privilege escalation

41RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.