Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

84.150exploits catalogados

39.601CVEs com exploração pública

24.695testados em laboratório

Todos Referência 25.629Exploit-DB 24.485GitHub PoC 16.343VulnCheck XDB 9.680Nuclei 4.488Metasploit 3.525✓ só verificadosrecentes populares risco

25.557 exploits

Referência✓ VexDay Proof

BuzzyWall 1.3.1 - 'search' SQL Injection

CVE-2008-6029—webappsphp

SQL injection vulnerability in search.php in BuzzyWall 1.3.1 and earlier, when magic_quotes_gpc is disabled, allows remo

23RISCO

abrir ↗

Referência✓ VexDay Proof

RiotPix 0.61 - 'forumid' Blind SQL Injection

CVE-2009-0110—webappsphp

SQL injection vulnerability in read.php in RiotPix 0.61 and earlier allows remote attackers to execute arbitrary SQL com

23RISCO

abrir ↗

Referência✓ VexDay Proof

DBHcms 1.1.4 - 'code' Remote File Inclusion

CVE-2008-1038—webappsphp

PHP remote file inclusion vulnerability in mod/mod.extmanager.php in DBHcms 1.1.4 and earlier allows remote attackers to

23RISCO

abrir ↗

Referência✓ VexDay Proof

cmreams CMS 1.3.1.1 beta2 - Local File Inclusion / Cross-Site Scripting

CVE-2008-2985—webappsphp

Directory traversal vulnerability in load_language.php in CMReams CMS 1.3.1.1 Beta 2, when register_globals is enabled,

23RISCO

abrir ↗

Referência✓ VexDay Proof

Vastal I-Tech Dating Zone - 'fage' SQL Injection

CVE-2008-4461—webappsphp

SQL injection vulnerability in advanced_search_results.php in Vastal I-Tech Dating Zone, possibly 0.9.9, allows remote a

23RISCO

abrir ↗

Referência

CVE-2014-0322

CVE-2014-0322HIGHsob ataque

Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code v

100RISCO

abrir ↗

Referência

CVE-2015-6132

CVE-2015-6132—

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2

60RISCO

abrir ↗

Referência

CVE-2026-16056

CVE-2026-16056MEDIUM

Contest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts

33RISCO

abrir ↗

Referência

CVE-2017-14491

CVE-2017-14491—

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut

45RISCO

abrir ↗

Referência

CVE-2023-38950

CVE-2023-38950HIGHsob ataque

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbit

100RISCO

abrir ↗

Referência

CVE-2017-14491

CVE-2017-14491—

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut

45RISCO

abrir ↗

Referência

CVE-2009-2335

CVE-2009-2335—

WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the u

60RISCO

abrir ↗

Referência

CVE-2026-12376

CVE-2026-12376MEDIUM

Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint

33RISCO

abrir ↗

Referência

CVE-2019-20361

CVE-2019-20361HIGH

There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to b

78RISCO

abrir ↗

Referência

CVE-2017-2741

CVE-2017-2741—

A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmwa

60RISCO

abrir ↗

Referência

CVE-2017-2741

CVE-2017-2741—

A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmwa

60RISCO

abrir ↗

Referência

CVE-2019-8449

CVE-2019-8449—

The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate username

60RISCO

abrir ↗

Referência

CVE-2012-0911

CVE-2012-0911—

TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted

50RISCO

abrir ↗

Referência✓ VexDay Proof

PHPBandManager 0.8 - 'index.php?pg' Remote File Inclusion

CVE-2007-2341—webappsphp

PHP remote file inclusion vulnerability in suite/index.php in phpBandManager 0.8 allows remote attackers to execute arbi

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHPUserBase 1.3b - 'unverified.inc.php' Remote File Inclusion

CVE-2008-1043—webappsphp

PHP remote file inclusion vulnerability in templates/default/header.inc.php in Linux Web Shop (LWS) php User Base 1.3 BE

35RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component FacileForms 1.4.4 - Remote File Inclusion

CVE-2008-2990—webappsphp

PHP remote file inclusion vulnerability in facileforms.frame.php in the FacileForms (com_facileforms) component 1.4.4 fo

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHP Realtor 1.5 - 'v_cat' SQL Injection

CVE-2008-4496—webappsphp

SQL injection vulnerability in view_cat.php in PHP Realtor 1.5 allows remote attackers to execute arbitrary SQL commands

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHP-Nuke Module Kose_Yazilari - 'artid' SQL Injection

CVE-2008-1053—webappsphp

Multiple SQL injection vulnerabilities in the Kose_Yazilari module for PHP-Nuke allow remote attackers to execute arbitr

23RISCO

abrir ↗

Referência

CVE-2018-1000006

CVE-2018-1000006—

GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the pro

60RISCO

abrir ↗

Referência

CVE-2015-7858

CVE-2015-7858—

SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via un

60RISCO

abrir ↗

Referência

CVE-2018-1000006

CVE-2018-1000006—

GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the pro

60RISCO

abrir ↗

Referência

CVE-2020-28949

CVE-2020-28949HIGHsob ataque

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper

100RISCO

abrir ↗

Referência

CVE-2019-20499

CVE-2019-20499—

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Config

60RISCO

abrir ↗

Referência✓ VexDay Proof

WSN Links Free 4.0.34P - 'comments.php' Blind SQL Injection

CVE-2008-6032—webappsphp

SQL injection vulnerability in comments.php in WSN Links Free 4.0.34P allows remote attackers to execute arbitrary SQL c

23RISCO

abrir ↗

Referência

CVE-2026-7097

CVE-2026-7097HIGH

Tenda F456 httpd webExcptypemanFilter fromwebExcptypemanFilter buffer overflow

41RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.