Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.151exploits catalogados

35.370CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.451Referência 22.233GitHub PoC 14.119VulnCheck XDB 8.617Nuclei 4.257Metasploit 3.474✓ só verificadosrecentes populares risco

22.233 exploits

Referência

CVE-2015-8351

CVE-2015-8351—

PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_includ

35RISCO

abrir ↗

Referência

CVE-2015-8351

CVE-2015-8351—

PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_includ

35RISCO

abrir ↗

Referência✓ VexDay Proof

VUPlayer 2.44 - '.m3u' UNC Name Buffer Overflow

CVE-2006-6251—localwindows

Stack-based buffer overflow in VUPlayer 2.44 and earlier allows remote attackers to execute arbitrary code via a long st

50RISCO

abrir ↗

Referência

CVE-2023-30806

CVE-2023-30806CRITICAL

Sangfor Next-Gen Application Firewall PHPSESSID Command Injection

60RISCO

abrir ↗

Referência

CVE-2023-30805

CVE-2023-30805CRITICAL

Sangfor Next-Gen Application Firewall Login Un Param Command Injection

60RISCO

abrir ↗

Referência

CVE-2013-1362

CVE-2013-1362—

Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote att

50RISCO

abrir ↗

Referência

CVE-2017-14147

CVE-2017-14147—

An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to ea

35RISCO

abrir ↗

Referência

CVE-2017-14147

CVE-2017-14147—

An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to ea

35RISCO

abrir ↗

Referência

CVE-2010-4279

CVE-2010-4279—

The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which al

50RISCO

abrir ↗

Referência

CVE-2010-4279

CVE-2010-4279—

The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which al

50RISCO

abrir ↗

Referência

CVE-2010-4279

CVE-2010-4279—

The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which al

50RISCO

abrir ↗

Referência

CVE-2011-3175

CVE-2011-3175—

Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allo

50RISCO

abrir ↗

Referência

CVE-2012-6625

CVE-2012-6625—

SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress

23RISCO

abrir ↗

Referência

CVE-2018-0837

CVE-2018-0837—

Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remot

35RISCO

abrir ↗

Referência

CVE-2018-0835

CVE-2018-0835—

Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remot

35RISCO

abrir ↗

Referência

CVE-2018-6328

CVE-2018-6328—

It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, w

50RISCO

abrir ↗

Referência

CVE-2018-6328

CVE-2018-6328—

It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, w

50RISCO

abrir ↗

Referência

CVE-2013-4074

CVE-2013-4074—

The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.

50RISCO

abrir ↗

Referência

CVE-2018-3639

CVE-2018-3639MEDIUM

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres

45RISCO

abrir ↗

Referência

CVE-2018-8770

CVE-2018-8770—

Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, contro

50RISCO

abrir ↗

Referência

CVE-2012-4333

CVE-2012-4333—

Multiple stack-based buffer overflows in the BackupToAvi method in the (1) UMS_Ctrl 1.5.1.1 and (2) UMS_Ctrl_STW 2.0.1.0

50RISCO

abrir ↗

Referência

CVE-2016-20017

CVE-2016-20017CRITICALsob ataque

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as

100RISCO

abrir ↗

Referência

CVE-2017-5941

CVE-2017-5941—

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() fu

35RISCO

abrir ↗

Referência

CVE-2017-5941

CVE-2017-5941—

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() fu

35RISCO

abrir ↗

Referência✓ VexDay Proof

XLAtunes 0.1 - 'album' SQL Injection

CVE-2007-1026—webappsphp

SQL injection vulnerability in view.php in XLAtunes 0.1 and earlier allows remote attackers to execute arbitrary SQL com

23RISCO

abrir ↗

Referência✓ VexDay Proof

SOTEeSKLEP 3.5RC9 - 'file' Remote File Disclosure

CVE-2007-4369—webappsphp

Directory traversal vulnerability in go/_files in SOTEeSKLEP before 4.0 allows remote attackers to read arbitrary files

23RISCO

abrir ↗

Referência

CVE-2025-40553

CVE-2025-40553CRITICAL

SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

60RISCO

abrir ↗

Referência

CVE-2017-15222

CVE-2017-15222—

Buffer Overflow vulnerability in Ayukov NFTPD 2.0 and earlier allows remote attackers to execute arbitrary code.

50RISCO

abrir ↗

Referência

CVE-2017-15222

CVE-2017-15222—

Buffer Overflow vulnerability in Ayukov NFTPD 2.0 and earlier allows remote attackers to execute arbitrary code.

50RISCO

abrir ↗

Referência

CVE-2016-3074

CVE-2016-3074—

Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of

35RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.