Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.057exploits catalogados

36.288CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.460Referência 22.910GitHub PoC 14.997VulnCheck XDB 8.843Nuclei 4.358Metasploit 3.489✓ só verificadosrecentes populares risco

22.832 exploits

Referência

CVE-2026-14656

CVE-2026-14656MEDIUM

code-projects Assessment Management remove-user.php cross site scripting

33RISCO

abrir ↗

Referência

CVE-2026-14655

CVE-2026-14655MEDIUM

code-projects Assessment Management view-users.php cross site scripting

33RISCO

abrir ↗

Referência

CVE-2026-15506

CVE-2026-15506HIGH

SecureAge CatchPulse Driver saappctl.sys heap-based overflow

41RISCO

abrir ↗

Referência

CVE-2026-15506

CVE-2026-15506HIGH

SecureAge CatchPulse Driver saappctl.sys heap-based overflow

41RISCO

abrir ↗

Referência

CVE-2026-15187

CVE-2026-15187MEDIUM

enquirer Public Package API Enquirer.set prototype pollution

33RISCO

abrir ↗

Referência

CVE-2026-15501

CVE-2026-15501MEDIUM

AstrBotDevs AstrBot MCP Test Endpoint tools.py ToolsRoute.test_mcp_connection server-side request forgery

33RISCO

abrir ↗

Referência

CVE-2026-59807

CVE-2026-59807HIGH

Composio SDK < 0.2.32-beta.283 - Sensitive File Upload via tool-file-uploads.ts

41RISCO

abrir ↗

Referência

CVE-2026-59804

CVE-2026-59804HIGH

Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket

41RISCO

abrir ↗

Referência

CVE-2026-59803

CVE-2026-59803HIGH

rpcx - Denial of Service via Gzip Decompression Bomb in Wire Protocol

41RISCO

abrir ↗

Referência

CVE-2026-15500

CVE-2026-15500MEDIUM

AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery

33RISCO

abrir ↗

Referência

CVE-2018-25367

CVE-2018-25367MEDIUM

NASA openVSP 3.16.1 Denial of Service via Buffer Overflow

33RISCO

abrir ↗

Referência

CVE-2018-25364

CVE-2018-25364HIGH

Twitter-Clone 1 SQL Injection via search.php

41RISCO

abrir ↗

Referência

CVE-2026-9529

CVE-2026-9529MEDIUM

GNU LibreDWG Dwggrep Utility dwggrep.c match_BLOCK_HEADER null pointer dereference

33RISCO

abrir ↗

Referência

CVE-2026-9526

CVE-2026-9526MEDIUM

itsourcecode Electronic Judging System edit_team.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-9525

CVE-2026-9525MEDIUM

itsourcecode Electronic Judging System edit_judge.php sql injection

33RISCO

abrir ↗

Referência

CVE-2018-17587

CVE-2018-17587—

AirTies Air 5750 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.

23RISCO

abrir ↗

Referência

CVE-2018-17587

CVE-2018-17587—

AirTies Air 5750 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.

23RISCO

abrir ↗

Referência✓ VexDay Proof

Pie Cart Pro - 'Home_Path' Remote File Inclusion

CVE-2006-4970—webappsphp

PHP remote file inclusion vulnerability in enc/content.php in WAHM E-Commerce Pie Cart Pro allows remote attackers to ex

23RISCO

abrir ↗

Referência✓ VexDay Proof

phpQuiz 0.1.2 - SQL Injection / Code Execution

CVE-2006-4978—webappsphp

Multiple SQL injection vulnerabilities in Walter Beschmout PhpQuiz 1.2 and earlier allow remote attackers to execute arb

23RISCO

abrir ↗

Referência

CVE-2026-9521

CVE-2026-9521MEDIUM

fraillt bitsery std_smart_ptr.h loadFromSharedState improper validation of specified type of input

33RISCO

abrir ↗

Referência

CVE-2026-9504

CVE-2026-9504MEDIUM

GNU LibreDWG Dwggrep Utility dwggrep.c bit_convert_TU out-of-bounds

33RISCO

abrir ↗

Referência

CVE-2018-25363

CVE-2018-25363MEDIUM

Twitter-Clone 1 Cross-Site Request Forgery via tweetdel.php

33RISCO

abrir ↗

Referência

CVE-2018-25362

CVE-2018-25362HIGH

Twitter-Clone 1 SQL Injection via follow.php

41RISCO

abrir ↗

Referência

CVE-2018-25361

CVE-2018-25361HIGH

Soroush IM Desktop App 0.17.0 Authentication Bypass via Database Injection

41RISCO

abrir ↗

Referência✓ VexDay Proof

PHP Blue Dragon CMS 2.9.1 - Cross-Site Scripting / SQL Injection Code Execution

CVE-2006-4962—webappsphp

Directory traversal vulnerability in pbd_engine.php in Php Blue Dragon 2.9.1 and earlier allows remote attackers to read

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHP Blue Dragon CMS 3.0.0 - Remote Code Execution

CVE-2006-4962—webappsphp

Directory traversal vulnerability in pbd_engine.php in Php Blue Dragon 2.9.1 and earlier allows remote attackers to read

23RISCO

abrir ↗

Referência

CVE-2026-13560

CVE-2026-13560MEDIUM

Edimax EW-7478APC POST Request formAccept os command injection

33RISCO

abrir ↗

Referência

CVE-2018-25360

CVE-2018-25360HIGH

AgataSoft Auto PingMaster 1.5 Buffer Overflow SEH

41RISCO

abrir ↗

Referência

CVE-2026-13558

CVE-2026-13558MEDIUM

CodeAstro Complaint Management System Report addreport cross site scripting

33RISCO

abrir ↗

Referência

CVE-2026-54092

CVE-2026-54092MEDIUM

File Browser: DoS Vulnerability on Public Login API

33RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.