Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

76.107exploits catalogados

34.679CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.443Referência 21.692GitHub PoC 13.812VulnCheck XDB 8.460Nuclei 4.233Metasploit 3.467✓ só verificadosrecentes populares risco

21.692 exploits

Referência

CVE-2017-0412

CVE-2017-0412—

An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbi

23RISCO

abrir ↗

Referência

CVE-2019-11504

CVE-2019-11504—

Zotonic before version 0.47 has mod_admin XSS.

23RISCO

abrir ↗

Referência

CVE-2019-11504

CVE-2019-11504—

Zotonic before version 0.47 has mod_admin XSS.

23RISCO

abrir ↗

Referência✓ VexDay Proof

fungamez rc1 - Authentication Bypass / Local File Inclusion

CVE-2009-1489—webappsphp

includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by set

23RISCO

abrir ↗

Referência✓ VexDay Proof

CaLogic Calendars 1.2.2 - 'CLPath' Remote File Inclusion

CVE-2006-2570—webappsphp

PHP remote file inclusion vulnerability in CaLogic Calendars 1.2.2 allows remote attackers to execute arbitrary PHP code

23RISCO

abrir ↗

Referência✓ VexDay Proof

Teraway LinkTracker 1.0 - Insecure Cookie Handling

CVE-2009-1617—webappsphp

Teraway LinkTracker 1.0 allows remote attackers to bypass authentication and gain administrative access via a userid=1&l

23RISCO

abrir ↗

Referência✓ VexDay Proof

PageSquid CMS 0.3 Beta - 'index.php' SQL Injection

CVE-2008-2897—webappsphp

SQL injection vulnerability in index.php in PageSquid CMS 0.3 Beta allows remote attackers to execute arbitrary SQL comm

23RISCO

abrir ↗

Referência✓ VexDay Proof

Chicomas 2.0.4 - Database Backup / File Disclosure / Cross-Site Scripting

CVE-2008-5853—webappsphp

Chilek Content Management System (aka ChiCoMaS) 2.0.4 and earlier stores sensitive information under the web root with i

23RISCO

abrir ↗

Referência✓ VexDay Proof

Absolute FAQ Manager 6.0 - Insecure Cookie Handling

CVE-2008-6854—webappsphp

Xigla Software Absolute FAQ Manager.NET 6.0 allows remote attackers to bypass authentication and gain administrative acc

23RISCO

abrir ↗

Referência✓ VexDay Proof

The Gemini Portal 4.7 - Insecure Cookie Handling

CVE-2008-7024—webappsphp

admin.php in Arz Development The Gemini Portal 4.7 and earlier allows remote attackers to bypass authentication and gain

23RISCO

abrir ↗

Referência

CVE-2018-11671

CVE-2018-11671—

An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php

23RISCO

abrir ↗

Referência

CVE-2010-2689

CVE-2010-2689—

SQL injection vulnerability in cont_form.php in Internet DM WebDM CMS allows remote attackers to execute arbitrary SQL c

23RISCO

abrir ↗

Referência

CVE-2018-11670

CVE-2018-11670—

An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to execute arbitrary

23RISCO

abrir ↗

Referência

CVE-2018-10312

CVE-2018-10312—

index.php?m=member&v=pw_reset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member.

23RISCO

abrir ↗

Referência✓ VexDay Proof

CASTOR 1.1.1 - '/lib/rs.php' Remote File Inclusion

CVE-2006-5480—webappsphp

PHP remote file inclusion vulnerability in lib/rs.php in 2le.net Castor PHP Web Builder 1.1.1 allows remote attackers to

23RISCO

abrir ↗

Referência

CVE-2010-2689

CVE-2010-2689—

SQL injection vulnerability in cont_form.php in Internet DM WebDM CMS allows remote attackers to execute arbitrary SQL c

23RISCO

abrir ↗

Referência

CVE-2010-2690

CVE-2010-2690—

SQL injection vulnerability in the JOOFORGE Gamesbox (com_gamesbox) component 1.0.2, and possibly earlier, for Joomla! a

23RISCO

abrir ↗

Referência✓ VexDay Proof

MiniHTTPServer Web Forum & File Sharing Server 4.0 - Add User

CVE-2006-5597—remotewindows

join.asp in MiniHTTP Web Forum & File Server PowerPack 4.0 allows remote attackers to add or modify arbitrary user accou

23RISCO

abrir ↗

Referência✓ VexDay Proof

PollHelper - Remote Configuration File Disclosure

CVE-2009-0827—webappsphp

PollHelper stores poll.inc under the web root with insufficient access control, which allows remote attackers to downloa

23RISCO

abrir ↗

Referência✓ VexDay Proof

ScarNews 1.2.1 - 'sn_admin_dir' Local File Inclusion

CVE-2007-1932—webappsphp

Directory traversal vulnerability in scarnews.inc.php in ScarNews 1.2.1 allows remote attackers to include and execute a

23RISCO

abrir ↗

Referência

CVE-2008-5322

CVE-2008-5322—

Wysi Wiki Wyg 1.0 allows remote attackers to obtain system information via an invalid categup parameter to index.php, wh

23RISCO

abrir ↗

Referência

CVE-2013-6883

CVE-2013-6883—

Cross-site request forgery (CSRF) vulnerability in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allow

23RISCO

abrir ↗

Referência

CVE-2013-6883

CVE-2013-6883—

Cross-site request forgery (CSRF) vulnerability in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allow

23RISCO

abrir ↗

Referência✓ VexDay Proof

My Little Forum 1.7 - 'user.php?id' SQL Injection

CVE-2007-2942—webappsphp

SQL injection vulnerability in user.php in My Little Forum 1.7 and earlier allows remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência✓ VexDay Proof

DreamLog 0.5 - 'upload.php' Arbitrary File Upload

CVE-2007-3403—webappsphp

Unrestricted file upload vulnerability in upload.php in dreamLog (aka dreamblog) 0.5 allows remote attackers to upload a

23RISCO

abrir ↗

Referência✓ VexDay Proof

LinPHA 1.3.1 - 'new_images.php' Blind SQL Injection

CVE-2007-4053—webappsphp

SQL injection vulnerability in include/img_view.class.php in LinPHA 1.3.1 and earlier allows remote attackers to execute

23RISCO

abrir ↗

Referência✓ VexDay Proof

Shop-Script FREE 2.0 - Remote Command Execution

CVE-2007-4932—webappsphp

admin.php in Shop-Script FREE 2.0 and earlier sends a redirect to the web browser but does not exit when administrative

23RISCO

abrir ↗

Referência

CVE-2017-9129

CVE-2017-9129—

The wav_open_read function in frontend/input.c in Freeware Advanced Audio Coder (FAAC) 1.28 allows remote attackers to c

23RISCO

abrir ↗

Referência✓ VexDay Proof

Gobbl CMS 1.0 - Insecure Cookie Handling

CVE-2008-5880—webappsphp

admin/auth.php in Gobbl CMS 1.0 allows remote attackers to bypass authentication and gain administrative access by setti

23RISCO

abrir ↗

Referência✓ VexDay Proof

ASPPortal 3.2.5 - Database Disclosure

CVE-2008-6382—webappsasp

ASP Portal 3.2.5 stores sensitive information under the web root with insufficient access control, which allows remote a

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.