Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.057exploits catalogados

36.288CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.460Referência 22.910GitHub PoC 14.997VulnCheck XDB 8.843Nuclei 4.358Metasploit 3.489✓ só verificadosrecentes populares risco

22.910 exploits

Referência

CVE-2026-9694

CVE-2026-9694LOW

Improper Neutralization of Substitution Characters in GitLab

28RISCO

abrir ↗

Referência

CVE-2026-10087

CVE-2026-10087HIGH

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

41RISCO

abrir ↗

Referência

CVE-2018-18772

CVE-2018-18772—

CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as dem

23RISCO

abrir ↗

Referência

CVE-2026-11476

CVE-2026-11476MEDIUM

Kushan2k student-management-system Profile Update Endpoint AdminController.php edit-admin improper authorization

33RISCO

abrir ↗

Referência

CVE-2026-11475

CVE-2026-11475MEDIUM

Kushan2k student-management-system Certificate Verification Endpoint GradeController.php getStatus sql injection

33RISCO

abrir ↗

Referência

CVE-2026-11474

CVE-2026-11474MEDIUM

Kushan2k student-management-system Registration Endpoint RegisterService.php unrestricted upload

33RISCO

abrir ↗

Referência

CVE-2026-11472

CVE-2026-11472MEDIUM

SourceCodester Class and Exam Timetabling System index1.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-11471

CVE-2026-11471MEDIUM

SourceCodester Class and Exam Timetabling System index2.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-11470

CVE-2026-11470MEDIUM

hs-web hsweb-framework File Upload FileUploadProperties.java denied path traversal

33RISCO

abrir ↗

Referência✓ VexDay Proof

phpDynaSite 3.2.2 - 'racine' Remote File Inclusion

CVE-2006-5760—webappsphp

Multiple PHP remote file inclusion vulnerabilities in phpDynaSite 3.2.2 and earlier allow remote attackers to execute ar

23RISCO

abrir ↗

Referência

CVE-2026-11469

CVE-2026-11469MEDIUM

jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery

33RISCO

abrir ↗

Referência✓ VexDay Proof

Free File Hosting 1.1 - 'forgot_pass.php' File Inclusion

CVE-2006-5762—webappsphp

PHP remote file inclusion vulnerability in forgot_pass.php in Free File Hosting 1.1 and earlier allows remote attackers

23RISCO

abrir ↗

Referência

CVE-2026-11468

CVE-2026-11468MEDIUM

SourceCodester Hospitals Patient Records Management System page room_types cross site scripting

33RISCO

abrir ↗

Referência✓ VexDay Proof

FreeWebShop.org script 2.2.2 - Multiple Vulnerabilities

CVE-2006-5772—webappsphp

Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 and earlier allow remote attackers to execute a

23RISCO

abrir ↗

Referência

CVE-2025-71318

CVE-2025-71318CRITICAL

NetMan 204 Missing Authentication for Administrative Functions

48RISCO

abrir ↗

Referência

CVE-2025-71317

CVE-2025-71317CRITICAL

NetMan 204 Hard-coded Backdoor Credentials

48RISCO

abrir ↗

Referência

CVE-2026-11344

CVE-2026-11344MEDIUM

code-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted upload

33RISCO

abrir ↗

Referência

CVE-2018-25359

CVE-2018-25359HIGH

Splinterware System Scheduler Pro 5.12 Privilege Escalation

41RISCO

abrir ↗

Referência

CVE-2026-9464

CVE-2026-9464MEDIUM

YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery

33RISCO

abrir ↗

Referência

CVE-2026-9462

CVE-2026-9462HIGH

Edimax EW-7438RPn formWpsProxyEnable stack-based overflow

41RISCO

abrir ↗

Referência

CVE-2026-9425

CVE-2026-9425HIGH

Edimax EW-7438RPn formWlanMP stack-based overflow

41RISCO

abrir ↗

Referência

CVE-2026-9424

CVE-2026-9424MEDIUM

Edimax EW-7438RPn Content-Type formWlanMP os command injection

33RISCO

abrir ↗

Referência

CVE-2026-9423

CVE-2026-9423MEDIUM

Edimax BR-6675nD POST Request mp command injection

33RISCO

abrir ↗

Referência

CVE-2026-9419

CVE-2026-9419MEDIUM

code-projects Employee Management System empproject.php cross site scripting

33RISCO

abrir ↗

Referência

CVE-2026-9418

CVE-2026-9418MEDIUM

code-projects Employee Management System changepassemp.php cross site scripting

33RISCO

abrir ↗

Referência

CVE-2026-9404

CVE-2026-9404CRITICAL

Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection

48RISCO

abrir ↗

Referência

CVE-2026-43633

CVE-2026-43633CRITICAL

HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal

48RISCO

abrir ↗

Referência✓ VexDay Proof

Creasito E-Commerce Content Manager - 'admin' Authentication Bypass

CVE-2006-5777—webappsphp

Creasito E-Commerce Content Manager 1.3.08 allows remote attackers to bypass authentication and perform privileged funct

23RISCO

abrir ↗

Referência

CVE-2018-25417

CVE-2018-25417HIGH

AiOPMSD Final 1.0.0 SQL Injection via quality.php

41RISCO

abrir ↗

Referência✓ VexDay Proof

Omni-NFS Server 5.2 - 'nfsd.exe' Remote Stack Overflow (Metasploit)

CVE-2006-5780—remotewindows

Stack-based buffer overflow in nfsd.exe in XLink Omni-NFS Server 5.2 allows remote attackers to execute arbitrary code v

50RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.