Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

76.647exploits catalogados

34.986CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.443Referência 21.899GitHub PoC 14.014VulnCheck XDB 8.571Nuclei 4.248Metasploit 3.472✓ só verificadosrecentes populares risco

21.899 exploits

Referência

CVE-2019-16173

CVE-2019-16173—

LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example,

23RISCO

abrir ↗

Referência

CVE-2022-2841

CVE-2022-2841LOW

CrowdStrike Falcon Uninstallation authorization

28RISCO

abrir ↗

Referência

CVE-2014-2340

CVE-2014-2340—

Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers

23RISCO

abrir ↗

Referência

CVE-2015-7567

CVE-2015-7567—

SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passw

23RISCO

abrir ↗

Referência

CVE-2015-7567

CVE-2015-7567—

SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passw

23RISCO

abrir ↗

Referência

CVE-2021-21465

CVE-2021-21465CRITICAL

The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the b

48RISCO

abrir ↗

Referência✓ VexDay Proof

JBlog 1.0 - Create / Delete Admin Authentication Bypass

CVE-2007-3974—webappsphp

admin/ajoutaut.php in JBlog 1.0 does not require authentication, which allows remote attackers to create arbitrary accou

23RISCO

abrir ↗

Referência

CVE-2018-14840

CVE-2018-14840—

uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for exam

23RISCO

abrir ↗

Referência✓ VexDay Proof

EDraw Flowchart ActiveX Control 2.0 - Insecure Method

CVE-2007-5826—remotewindows

Absolute path traversal vulnerability in the EDraw Flowchart ActiveX control in EDImage.ocx 2.0.2005.1104 allows remote

23RISCO

abrir ↗

Referência✓ VexDay Proof

bloofox 0.3 - SQL Injection / File Disclosure

CVE-2008-0427—webappsphp

Directory traversal vulnerability in file.php in bloofoxCMS 0.3 allows remote attackers to read arbitrary files via a ..

23RISCO

abrir ↗

Referência✓ VexDay Proof

Acidcat CMS 3.4.1 - Multiple Vulnerabilities

CVE-2008-1993—webappsphp

Acidcat CMS 3.4.1 does not restrict access to the FCKEditor component, which allows remote attackers to upload arbitrary

23RISCO

abrir ↗

Referência✓ VexDay Proof

Google Chrome 0.2.149.27 - Inspect Element Denial of Service

CVE-2008-6997—doswindows

Google Chrome 0.2.149.27 allows user-assisted remote attackers to cause a denial of service (browser crash) via an IMG t

23RISCO

abrir ↗

Referência

CVE-2014-0870

CVE-2014-0870—

Multiple cross-site scripting (XSS) vulnerabilities in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 be

23RISCO

abrir ↗

Referência✓ VexDay Proof

Xomol CMS 1.2 - Authentication Bypass / Local File Inclusion

CVE-2008-2483—webappsphp

Directory traversal vulnerability in index.php in Xomol CMS 1.20071213 allows remote attackers to include and execute ar

23RISCO

abrir ↗

Referência

CVE-2017-9095

CVE-2017-9095—

XXE in Diving Log 6.0 allows attackers to remotely view local files through a crafted dive.xml file that is mishandled d

23RISCO

abrir ↗

Referência

CVE-2010-1304

CVE-2010-1304—

Directory traversal vulnerability in userstatus.php in the User Status (com_userstatus) component 1.21.16 for Joomla! al

43RISCO

abrir ↗

Referência

CVE-2010-1305

CVE-2010-1305—

Directory traversal vulnerability in jinventory.php in the JInventory (com_jinventory) component 1.23.02 and possibly ot

43RISCO

abrir ↗

Referência✓ VexDay Proof

Xomol CMS 1.2 - Authentication Bypass / Local File Inclusion

CVE-2008-2484—webappsphp

SQL injection vulnerability in index.php in Xomol CMS 1.20071213, when magic_quotes_gpc is disabled, allows remote attac

23RISCO

abrir ↗

Referência

CVE-2007-2373

CVE-2007-2373—

SQL injection vulnerability in viewcat.php in the WF-Links (wflinks) 1.03 and earlier module for XOOPS allows remote att

23RISCO

abrir ↗

Referência

CVE-2019-0735

CVE-2019-0735—

An elevation of privilege vulnerability exists when the Windows Client Server Run-Time Subsystem (CSRSS) fails to proper

23RISCO

abrir ↗

Referência

CVE-2016-7188

CVE-2016-7188—

The Standard Collector Service in Windows Diagnostics Hub in Microsoft Windows 10 Gold, 1511, and 1607 mishandles librar

23RISCO

abrir ↗

Referência

CVE-2016-0093

CVE-2016-0093—

The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, W

23RISCO

abrir ↗

Referência

CVE-2017-17062

CVE-2017-17062—

The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev4

23RISCO

abrir ↗

Referência

CVE-2017-17062

CVE-2017-17062—

The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev4

23RISCO

abrir ↗

Referência✓ VexDay Proof

pafileDB 2.0.1 - 'mxBB'/'phpBB' Remote File Inclusion

CVE-2006-2361—webappsphp

PHP remote file inclusion vulnerability in pafiledb_constants.php in Download Manager (mxBB pafiledb) integration, as us

23RISCO

abrir ↗

Referência

CVE-2025-10162

CVE-2025-10162HIGH

OrderConvo < 14 - Unauthenticated Arbitrary File Read

56RISCO

abrir ↗

Referência

CVE-2017-17612

CVE-2017-17612—

Hot Scripts Clone 3.1 has SQL Injection via the /categories subctid or mctid parameter.

23RISCO

abrir ↗

Referência

CVE-2017-17612

CVE-2017-17612—

Hot Scripts Clone 3.1 has SQL Injection via the /categories subctid or mctid parameter.

23RISCO

abrir ↗

Referência

CVE-2017-17612

CVE-2017-17612—

Hot Scripts Clone 3.1 has SQL Injection via the /categories subctid or mctid parameter.

23RISCO

abrir ↗

Referência

CVE-2017-0058

CVE-2017-0058—

A Win32k information disclosure vulnerability exists in Microsoft Windows when the win32k component improperly provides

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.