Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

76.008exploits catalogados

34.638CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.443Referência 21.662GitHub PoC 13.743VulnCheck XDB 8.460Nuclei 4.233Metasploit 3.467✓ só verificadosrecentes populares risco

21.662 exploits

Referência

CVE-2013-7043

CVE-2013-7043—

Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Scientific Atlanta DPR2320R2 routers with software 2

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHPEasyData Pro 2.2.2 - 'index.php' SQL Injection

CVE-2006-5707—webappsphp

SQL injection vulnerability in index.php in PHPEasyData Pro 1.4.1 and 2.2.1 allows remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência✓ VexDay Proof

AuraCMS 2.1 - Remote File Attachment / Local File Inclusion

CVE-2007-4886—webappsphp

Incomplete blacklist vulnerability in index.php in AuraCMS 1.x and probably 2.x allows remote attackers to execute arbit

23RISCO

abrir ↗

Referência✓ VexDay Proof

WebSihirbazi 5.1.1 - 'pageid' SQL Injection

CVE-2007-6556—webappsphp

Multiple SQL injection vulnerabilities in websihirbazi 5.1.1 allow remote attackers to execute arbitrary SQL commands vi

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component mediaslide - 'albumnum' Blind SQL Injection

CVE-2008-0802—webappsphp

SQL injection vulnerability in index.php in the MediaSlide (com_mediaslide) 0.5 component for Joomla! allows remote atta

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component Acajoom 1.1.5 - SQL Injection

CVE-2008-1427—webappsphp

SQL injection vulnerability in the Joobi Acajoom (com_acajoom) 1.1.5 and 1.2.5 component for Joomla! allows remote attac

23RISCO

abrir ↗

Referência✓ VexDay Proof

ClickAuction - Authentication Bypass

CVE-2009-0297—webappsphp

SQL injection vulnerability in login_check.asp in ClickAuction allows remote attackers to execute arbitrary SQL commands

23RISCO

abrir ↗

Referência

CVE-2017-15959

CVE-2017-15959—

Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-200

23RISCO

abrir ↗

Referência

CVE-2017-15959

CVE-2017-15959—

Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-200

23RISCO

abrir ↗

Referência

CVE-2023-5241

CVE-2023-5241CRITICAL

AI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file

48RISCO

abrir ↗

Referência

CVE-2014-9235

CVE-2014-9235—

Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated

23RISCO

abrir ↗

Referência

CVE-2010-3148

CVE-2010-3148—

Untrusted search path vulnerability in Microsoft Visio 2003 SP3 allows local users to gain privileges via a Trojan horse

28RISCO

abrir ↗

Referência

CVE-2010-3149

CVE-2010-3149—

Untrusted search path vulnerability in Adobe Device Central CS5 3.0.0(376), 3.0.1.0 (3027), and probably other versions

28RISCO

abrir ↗

Referência

CVE-2010-3151

CVE-2010-3151—

Untrusted search path vulnerability in Adobe On Location CS4 Build 315 allows local users, and possibly remote attackers

28RISCO

abrir ↗

Referência

CVE-2017-14703

CVE-2017-14703—

SQL injection vulnerability in Cash Back Comparison Script 1.0 allows remote attackers to execute arbitrary SQL commands

23RISCO

abrir ↗

Referência

CVE-2018-7886

CVE-2018-7886—

An issue was discovered in CloudMe 1.11.0. An unauthenticated local attacker that can connect to the "CloudMe Sync" clie

23RISCO

abrir ↗

Referência

CVE-2010-5040

CVE-2010-5040—

PHP remote file inclusion vulnerability in nucleus/plugins/NP_gallery.php in the NP_Gallery plugin 0.94 for Nucleus allo

23RISCO

abrir ↗

Referência

CVE-2026-4164

CVE-2026-4164CRITICAL

Wavlink WL-WN578W2 POST Request wireless.cgi GuestWifi command injection

48RISCO

abrir ↗

Referência

CVE-2009-2393

CVE-2009-2393—

admin/index.php in Virtuenetz Virtue Online Test Generator does not require administrative privileges, which allows remo

23RISCO

abrir ↗

Referência✓ VexDay Proof

DeluxeBB 1.2 - Multiple Vulnerabilities

CVE-2008-2195—webappsphp

Static code injection vulnerability in admincp.php in DeluxeBB 1.2 and earlier allows remote authenticated administrator

23RISCO

abrir ↗

Referência✓ VexDay Proof

NukeSentinel 2.5.05 - 'nsbypass.php' Blind SQL Injection

CVE-2007-1171—webappsphp

SQL injection vulnerability in includes/nsbypass.php in NukeSentinel 2.5.05, 2.5.11, and other versions before 2.5.12 al

23RISCO

abrir ↗

Referência✓ VexDay Proof

Alstrasoft Forum Pay Per Post Exchange 2.0 - SQL Injection

CVE-2008-0440—webappsphp

AlstraSoft Forum Pay Per Post Exchange 2.0 stores passwords in cleartext, which makes it easier for attackers to access

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component PU Arcade 2.1.3 - SQL Injection

CVE-2007-6663—webappsphp

SQL injection vulnerability in (1) Puarcade.php and (2) PUarcade.html.php in Pragmatic Utopia PU Arcade (com_puarcade) 2

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component iDoBlog b24 - SQL Injection

CVE-2008-2627—webappsphp

SQL injection vulnerability in the IDoBlog (com_idoblog) component b24 and earlier and 1.0, a component for Joomla!, all

23RISCO

abrir ↗

Referência✓ VexDay Proof

Post Affiliate Pro 2.0 - 'md' Local File Inclusion

CVE-2008-4602—webappsphp

Directory traversal vulnerability in index.php in Post Affiliate Pro 2.0 allows remote authenticated users to read and p

23RISCO

abrir ↗

Referência✓ VexDay Proof

PLog 1.0.6 - 'albumID' SQL Injection

CVE-2008-2629—webappsphp

SQL injection vulnerability in the LifeType (formerly pLog) module for Drupal allows remote attackers to execute arbitra

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHPcounter 1.3.2 - 'defs.php' Local File Inclusion

CVE-2008-5989—webappsphp

Directory traversal vulnerability in defs.php in PHPcounter 1.3.2 and earlier, when magic_quotes_gpc is disabled, allows

23RISCO

abrir ↗

Referência✓ VexDay Proof

Telephone Directory 2008 - SQL Injection / Cross-Site Scripting

CVE-2008-2678—webappsphp

Multiple SQL injection vulnerabilities in Telephone Directory 2008, when magic_quotes_gpc is disabled, allow remote atta

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHPmyGallery 1.0beta2 - Local/Remote File Inclusion

CVE-2008-6315—webappsphp

PHP remote file inclusion vulnerability in _conf/core/common-tpl-vars.php in PHPmyGallery 1.0 beta2 allows remote attack

23RISCO

abrir ↗

Referência✓ VexDay Proof

CMSbright - 'id_rub_page' SQL Injection

CVE-2008-6991—webappsphp

SQL injection vulnerability in public/page.php in Websens CMSbright allows remote attackers to execute arbitrary SQL com

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.