Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
80.095exploits catalogados
36.945CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.476Referência 23.442GitHub PoC 15.312VulnCheck XDB 8.970Nuclei 4.393Metasploit 3.502✓ só verificadosrecentespopularesrisco
24.476 exploits
Exploit-DB
Nice PHP FAQ Script - 'nice_theme' SQL Injection
Nice PHP FAQ Script allows SQL Injection via the index.php nice_theme parameter, a different vulnerability than CVE-2008
23RISCO
abrir ↗Exploit-DB
Ingenious 2.3.0 - Arbitrary File Upload
my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.
23RISCO
abrir ↗Exploit-DB
Same Sex Dating Software Pro 1.0 - SQL Injection
Same Sex Dating Software Pro 1.0 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php send
23RISCO
abrir ↗Exploit-DB
Fake Magazine Cover Script - SQL Injection
Fake Magazine Cover Script allows SQL Injection via the rate.php value parameter or the content.php id parameter.
23RISCO
abrir ↗Exploit-DB
SoftDatepro Dating Social Network 1.3 - SQL Injection
SoftDatepro Dating Social Network 1.3 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php
23RISCO
abrir ↗Exploit-DB
PHP CityPortal 2.0 - SQL Injection
PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter.
23RISCO
abrir ↗Exploit-DB
Joomla! Component NS Download Shop 2.2.6 - 'id' SQL Injection
The NS Download Shop (aka com_ns_downloadshop) component 2.2.6 for Joomla! allows SQL Injection via the id parameter in
23RISCO
abrir ↗Exploit-DB
Basic B2B Script - SQL Injection
Basic B2B Script allows SQL Injection via the product_view1.php pid or id parameter.
23RISCO
abrir ↗Exploit-DB
CmsLite 1.4 - 'S' SQL Injection
Creative Management System (CMS) Lite 1.4 allows SQL Injection via the S parameter to index.php.
23RISCO
abrir ↗Exploit-DB
AROX School ERP PHP Script - 'id' SQL Injection
AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter.
23RISCO
abrir ↗Exploit-DB✓ VexDay Proof
Oracle Java SE - Web Start jnlp XML External Entity Processing Information Disclosure
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affecte
23RISCO
abrir ↗Exploit-DB
ZeeBuddy 2x - 'groupid' SQL Injection
ZeeBuddy 2x allows SQL Injection via the admin/editadgroup.php groupid parameter, a different vulnerability than CVE-200
23RISCO
abrir ↗Exploit-DB
Sokial Social Network Script 1.0 - SQL Injection
Sokial Social Network Script 1.0 allows SQL Injection via the id parameter to admin/members_view.php.
23RISCO
abrir ↗Exploit-DB
Protected Links - SQL Injection
Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter.
23RISCO
abrir ↗Exploit-DB
iStock Management System 1.0 - Arbitrary File Upload
iStock Management System 1.0 allows Arbitrary File Upload via user/profile.
23RISCO
abrir ↗Exploit-DB
Adult Script Pro 2.2.4 - SQL Injection
Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-200
23RISCO
abrir ↗Exploit-DB
Job Board Script - 'nice_theme' SQL Injection
Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI.
23RISCO
abrir ↗Exploit-DB
Zomato Clone Script - 'resid' SQL Injection
Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter.
23RISCO
abrir ↗Exploit-DB
Php Inventory - Arbitrary File Upload
Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit_myaccountdetail/.
23RISCO
abrir ↗Exploit-DB
D-Park Pro 1.0 - SQL Injection
D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.
23RISCO
abrir ↗Exploit-DB
Online Exam Test Application - 'sort' SQL Injection
Online Exam Test Application allows SQL Injection via the resources.php sort parameter in a category action.
23RISCO
abrir ↗Exploit-DB
tPanel 2009 - Authentication Bypass
tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php.
23RISCO
abrir ↗Exploit-DB
PHPMyFAQ 2.9.8 - Cross-Site Scripting (3)
In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment.
23RISCO
abrir ↗Exploit-DB
PHP Melody 2.6.1 - SQL Injection
In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.
23RISCO
abrir ↗Exploit-DB
phpMyFAQ 2.9.8 - Cross-Site Request Forgery
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.
23RISCO
abrir ↗Exploit-DB
Watchdog Development Anti-Malware / Online Security Pro - NULL Pointer Dereference
In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointer
23RISCO
abrir ↗Exploit-DB
Watchdog Development Anti-Malware / Online Security Pro - NULL Pointer Dereference
In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointer
23RISCO
abrir ↗Exploit-DB
HitmanPro 3.7.15 Build 281 - Kernel Pool Overflow
A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in
23RISCO
abrir ↗Exploit-DB
PHPMailer < 5.2.21 - Local File Disclosure
An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML docume
23RISCO
abrir ↗Exploit-DB
KeystoneJS 4.0.0-beta.5 - CSV Excel Macro Injection
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCS
23RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.