Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

76.008exploits catalogados

34.638CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.443Referência 21.662GitHub PoC 13.743VulnCheck XDB 8.460Nuclei 4.233Metasploit 3.467✓ só verificadosrecentes populares risco

21.662 exploits

Referência

CVE-2010-4145

CVE-2010-4145—

Kisisel Radyo Script stores sensitive information under the web root with insufficient access control, which allows remo

23RISCO

abrir ↗

Referência

CVE-2010-4145

CVE-2010-4145—

Kisisel Radyo Script stores sensitive information under the web root with insufficient access control, which allows remo

23RISCO

abrir ↗

Referência

CVE-2009-4626

CVE-2009-4626—

Directory traversal vulnerability in menu.php in phpNagios 1.2.0 allows remote attackers to include and execute arbitrar

23RISCO

abrir ↗

Referência

CVE-2021-3186

CVE-2021-3186—

A Stored Cross-site scripting (XSS) vulnerability in /main.html Wifi Settings in Tenda AC5 AC1200 version V15.03.06.47_m

23RISCO

abrir ↗

Referência

CVE-2017-17649

CVE-2017-17649—

Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter.

23RISCO

abrir ↗

Referência

CVE-2017-17649

CVE-2017-17649—

Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter.

23RISCO

abrir ↗

Referência

CVE-2018-15884

CVE-2018-15884—

RICOH MP C4504ex devices allow HTML Injection via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.

23RISCO

abrir ↗

Referência

CVE-2018-15884

CVE-2018-15884—

RICOH MP C4504ex devices allow HTML Injection via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.

23RISCO

abrir ↗

Referência

CVE-2009-4118

CVE-2009-4118—

The StartServiceCtrlDispatcher function in the cvpnd service (cvpnd.exe) in Cisco VPN client for Windows before 5.0.06.0

23RISCO

abrir ↗

Referência

CVE-2018-16252

CVE-2018-16252—

FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection.

23RISCO

abrir ↗

Referência

CVE-2019-13657

CVE-2019-13657CRITICAL

CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that

48RISCO

abrir ↗

Referência

CVE-2019-13657

CVE-2019-13657CRITICAL

CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that

48RISCO

abrir ↗

Referência

CVE-2013-7193

CVE-2013-7193—

Multiple SQL injection vulnerabilities in C2C Forward Auction Creator 2.0 allow remote attackers to execute arbitrary SQ

23RISCO

abrir ↗

Referência✓ VexDay Proof

gnopaste 0.5.3 - 'common.php' Remote File Inclusion

CVE-2006-2834—webappsphp

PHP remote file inclusion vulnerability in includes/common.php in gnopaste 0.5.3 and earlier allows remote attackers to

23RISCO

abrir ↗

Referência✓ VexDay Proof

Enthrallweb eClassifieds 1.0 - Remote User Pass Change

CVE-2006-6822—webappsasp

myprofile.asp in Enthrallweb eClassifieds does not properly validate the MM_recordId parameter during profile updates, w

23RISCO

abrir ↗

Referência✓ VexDay Proof

Tuned Studios Templates - Local File Inclusion

CVE-2008-0231—webappsphp

Multiple directory traversal vulnerabilities in index.php in Tuned Studios (1) Subwoofer, (2) Freeze Theme, (3) Orange C

23RISCO

abrir ↗

Referência✓ VexDay Proof

BigACE 2.4 - Multiple Remote File Inclusions

CVE-2008-2520—webappsphp

Multiple PHP remote file inclusion vulnerabilities in BigACE 2.4, when register_globals is enabled, allow remote attacke

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHP-Ring Webring System 0.9.1 - Insecure Cookie Handling

CVE-2008-3602—webappsphp

admin/wr_admin.php in PHP-Ring Webring System (aka uPHP_ring_website) 0.9.1 allows remote attackers to bypass authentica

23RISCO

abrir ↗

Referência✓ VexDay Proof

Mini Blog 1.0.1 - 'index.php' Multiple Local File Inclusions

CVE-2008-5594—webappsphp

Multiple directory traversal vulnerabilities in index.php in Mini Blog 1.0.1 allow remote attackers to include and execu

23RISCO

abrir ↗

Referência✓ VexDay Proof

AJ Auction - Authentication Bypass

CVE-2008-6966—webappsphp

AJ Square AJ Auction Pro Platinum Skin #1 sends a redirect but does not exit when it is called directly, which allows re

23RISCO

abrir ↗

Referência

CVE-2009-3317

CVE-2009-3317—

PHP remote file inclusion vulnerability in pages/pageHeader.php in OpenSiteAdmin 0.9.7 BETA allows remote attackers to e

23RISCO

abrir ↗

Referência

CVE-2010-2694

CVE-2010-2694—

SQL injection vulnerability in the redSHOP Component (com_redshop) 1.0 for Joomla! allows remote attackers to execute ar

23RISCO

abrir ↗

Referência

CVE-2016-2782

CVE-2016-2782—

The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attack

23RISCO

abrir ↗

Referência✓ VexDay Proof

AssoCIateD CMS 1.1.3 - 'ROOT_PATH' Remote File Inclusion

CVE-2006-2841—webappsphp

Multiple PHP remote file inclusion vulnerabilities in AssoCIateD (aka ACID) CMS 1.1.3 allow remote attackers to execute

23RISCO

abrir ↗

Referência

CVE-2014-5284

CVE-2014-5284—

host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, whi

23RISCO

abrir ↗

Referência

CVE-2018-9173

CVE-2018-9173—

Cross-site scripting (XSS) vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows rem

23RISCO

abrir ↗

Referência✓ VexDay Proof

Phaos 0.9.2 - 'basename()' Remote Command Execution

CVE-2006-4420—webappsphp

Directory traversal vulnerability in include_lang.php in Phaos 0.9.2 allows remote attackers to include arbitrary local

23RISCO

abrir ↗

Referência

CVE-2016-1000125

CVE-2016-1000125—

Unauthenticated SQL Injection in Huge-IT Catalog v1.0.7 for Joomla

23RISCO

abrir ↗

Referência✓ VexDay Proof

NuralStorm Webmail 0.98b - 'process.php' Remote File Inclusion

CVE-2006-5386—webappsphp

PHP remote file inclusion vulnerability in process.php in NuralStorm Webmail 0.98b and earlier, when register_globals is

23RISCO

abrir ↗

Referência✓ VexDay Proof

Ultimate HelpDesk - Cross-Site Scripting / Local File Disclosure

CVE-2006-6381—webappsasp

Directory traversal vulnerability in getfile.asp in Ultimate HelpDesk allows remote attackers to read arbitrary files vi

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.