Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.020exploits catalogados

35.276CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.446Referência 22.166GitHub PoC 14.080VulnCheck XDB 8.604Nuclei 4.251Metasploit 3.473✓ só verificadosrecentes populares risco

22.166 exploits

Referência

CVE-2012-1613

CVE-2012-1613—

Cross-site scripting (XSS) vulnerability in edit_one_pic.php in Coppermine Photo Gallery before 1.5.20 allows remote aut

23RISCO

abrir ↗

Referência

CVE-2017-16962

CVE-2017-16962—

The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities vi

23RISCO

abrir ↗

Referência

CVE-2017-16962

CVE-2017-16962—

The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities vi

23RISCO

abrir ↗

Referência

CVE-2011-4673

CVE-2011-4673—

SQL injection vulnerability in modules/sharedaddy.php in the Jetpack plugin for WordPress allows remote attackers to exe

23RISCO

abrir ↗

Referência

MyT Project Management 1.5.1 - User[username] Persistent Cross-Site Scripting

CVE-2019-13346—webappsphp

In MyT 1.5.1, the User[username] parameter has XSS.

23RISCO

abrir ↗

Referência

CVE-2026-10230

CVE-2026-10230MEDIUM

Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_animations heap-based overflow

33RISCO

abrir ↗

Referência

CVE-2019-7004

CVE-2019-7004MEDIUM

Avaya IP Office XSS Vulnerability

33RISCO

abrir ↗

Referência✓ VexDay Proof

CcMail 1.0.1 - Insecure Cookie Handling

CVE-2008-1904—webappsphp

Cicoandcico CcMail 1.0.1 and earlier does not verify that the this_cookie cookie corresponds to an authenticated session

23RISCO

abrir ↗

Referência

CVE-2010-0665

CVE-2010-0665—

JAG (Just Another Guestbook) 1.14 stores sensitive information under the web root with insufficient access control, whic

23RISCO

abrir ↗

Referência✓ VexDay Proof

Download Accelerator Plus DAP 8.x - '.m3u' File Buffer Overflow

CVE-2008-3182—localwindows

Stack-based buffer overflow in DAP.exe in Download Accelerator Plus (DAP) 7.0.1.3, 8.6.6.3, and other 8.x versions allow

23RISCO

abrir ↗

Referência✓ VexDay Proof

Download Accelerator Plus DAP 8.x - '.m3u' Local Buffer Overflow

CVE-2008-3182—localwindows

Stack-based buffer overflow in DAP.exe in Download Accelerator Plus (DAP) 7.0.1.3, 8.6.6.3, and other 8.x versions allow

23RISCO

abrir ↗

Referência✓ VexDay Proof

CCLeague Pro 1.2 - Insecure Cookie Authentication

CVE-2008-5125—webappsphp

admin.php in CCleague Pro 1.2 allows remote attackers to bypass authentication by setting the type cookie value to admin

23RISCO

abrir ↗

Referência✓ VexDay Proof

TxtBlog 1.0 Alpha - Local File Inclusion

CVE-2008-5639—webappsphp

Directory traversal vulnerability in index.php in TxtBlog 1.0 Alpha allows remote attackers to read arbitrary files via

23RISCO

abrir ↗

Referência✓ VexDay Proof

4Images 1.7.7 - Filter Bypass HTML Injection / Cross-Site Scripting

CVE-2009-2131—webappsphp

Cross-site scripting (XSS) vulnerability in 4images 1.7.7 and earlier allows remote authenticated users to inject arbitr

23RISCO

abrir ↗

Referência

CVE-2010-4400

CVE-2010-4400—

SQL injection vulnerability in _rights.php in DynPG CMS 4.2.0 allows remote attackers to execute arbitrary SQL commands

23RISCO

abrir ↗

Referência

CVE-2010-4400

CVE-2010-4400—

SQL injection vulnerability in _rights.php in DynPG CMS 4.2.0 allows remote attackers to execute arbitrary SQL commands

23RISCO

abrir ↗

Referência

CVE-2013-5716

CVE-2013-5716—

Gretech GOM Media Player 2.2.53.5169 and possibly earlier allows remote attackers to cause a denial of service (applicat

23RISCO

abrir ↗

Referência

CVE-2010-0754

CVE-2010-0754—

Cross-site scripting (XSS) vulnerability in index.php/Special/Main/Templates in WikyBlog 1.7.2 and 1.7.3 rc2 allows remo

23RISCO

abrir ↗

Referência

CVE-2010-0754

CVE-2010-0754—

Cross-site scripting (XSS) vulnerability in index.php/Special/Main/Templates in WikyBlog 1.7.2 and 1.7.3 rc2 allows remo

23RISCO

abrir ↗

Referência

CVE-2010-4874

CVE-2010-4874—

Multiple cross-site scripting (XSS) vulnerabilities in users.php in NinkoBB 1.3 RC5 allow remote attackers to inject arb

23RISCO

abrir ↗

Referência

CVE-2010-4874

CVE-2010-4874—

Multiple cross-site scripting (XSS) vulnerabilities in users.php in NinkoBB 1.3 RC5 allow remote attackers to inject arb

23RISCO

abrir ↗

Referência

CVE-2010-3137

CVE-2010-3137—

Untrusted search path vulnerability in Nullsoft Winamp 5.581, and probably other versions, allows local users, and possi

23RISCO

abrir ↗

Referência

CVE-2025-12735

CVE-2025-12735CRITICAL

CVE-2025-12735

48RISCO

abrir ↗

Referência

CVE-2009-4657

CVE-2009-4657—

The administrator package for Xerver 4.32 does not require authentication, which allows remote attackers to alter applic

23RISCO

abrir ↗

Referência✓ VexDay Proof

MySpeach 2.1b - 'up.php' Remote File Inclusion

CVE-2007-0498—webappsphp

PHP remote file inclusion vulnerability in up.php in MySpeach 2.1 beta and possibly earlier allows remote attackers to e

23RISCO

abrir ↗

Referência

CVE-2013-10038

CVE-2013-10038CRITICAL

FlashChat Arbitrary File Upload RCE

63RISCO

abrir ↗

Referência

CVE-2016-7661

CVE-2016-7661—

An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. The is

23RISCO

abrir ↗

Referência

CVE-2017-15958

CVE-2017-15958—

D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.

23RISCO

abrir ↗

Referência

CVE-2017-15958

CVE-2017-15958—

D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.

23RISCO

abrir ↗

Referência✓ VexDay Proof

iziContents rc6 - Local/Remote File Inclusion

CVE-2007-5053—webappsphp

Multiple incomplete blacklist vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to execute arbitra

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.