Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.302exploits catalogados

35.469CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.451Referência 22.301GitHub PoC 14.141VulnCheck XDB 8.646Nuclei 4.289Metasploit 3.474✓ só verificadosrecentes populares risco

22.301 exploits

Referência

CVE-2011-5005

CVE-2011-5005—

Unrestricted file upload vulnerability in QuiXplorer 2.3 and earlier allows remote attackers to execute arbitrary code b

23RISCO

abrir ↗

Referência

CVE-2026-7744

CVE-2026-7744MEDIUM

CodeAstro Online Classroom addnewstudent sql injection

33RISCO

abrir ↗

Referência

CVE-2026-56122

CVE-2026-56122HIGH

Winstone Servlet Engine 0.9.10 Path Traversal via HTTP Request Paths

41RISCO

abrir ↗

Referência

CVE-2026-9702

CVE-2026-9702HIGH

InPost PL < 1.9.1 - Unauthenticated WooCommerce Order Parcel-Locker Hijacking

41RISCO

abrir ↗

Referência

CVE-2010-1653

CVE-2010-1653—

Directory traversal vulnerability in graphics.php in the Graphics (com_graphics) component 1.0.6 and 1.5.0 for Joomla! a

43RISCO

abrir ↗

Referência

CVE-2026-56121

CVE-2026-56121CRITICAL

Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization

48RISCO

abrir ↗

Referência

CVE-2026-56111

CVE-2026-56111HIGH

Marlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code Handler

41RISCO

abrir ↗

Referência✓ VexDay Proof

adaptweb 0.9.2 - Local File Inclusion / SQL Injection

CVE-2009-2152—webappsphp

SQL injection vulnerability in a_index.php in AdaptWeb 0.9.2 allows remote attackers to execute arbitrary SQL commands v

23RISCO

abrir ↗

Referência

CVE-2025-32433

CVE-2025-32433CRITICALsob ataque

Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

100RISCO

abrir ↗

Referência

CVE-2026-7732

CVE-2026-7732MEDIUM

code-projects BloodBank Managing System request_blood.php unrestricted upload

33RISCO

abrir ↗

Referência

WonderCMS 3.4.2 - Remote Code Execution (RCE)

CVE-2023-41425MEDIUMremotephp

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code

60RISCO

abrir ↗

Referência

CVE-2022-43769

CVE-2022-43769HIGHsob ataque

Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

100RISCO

abrir ↗

Referência

CVE-2023-4174

CVE-2023-4174LOW

mooSocial mooStore cross site scripting

43RISCO

abrir ↗

Referência

CVE-2019-18818

CVE-2019-18818—

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s

60RISCO

abrir ↗

Referência✓ VexDay Proof

Newxooper-PHP 0.9.1 - 'mapage.php' Remote File Inclusion

CVE-2006-6711—webappsphp

PHP remote file inclusion vulnerability in compteur/mapage.php in Newxooper 0.9.1 allows remote attackers to execute arb

23RISCO

abrir ↗

Referência

CVE-2011-5257

CVE-2011-5257—

Multiple cross-site scripting (XSS) vulnerabilities in the Classipress theme before 3.1.5 for WordPress allow remote att

23RISCO

abrir ↗

Referência✓ VexDay Proof

PowerClan 1.14a - 'footer.inc.php' Remote File Inclusion

CVE-2006-6715—webappsphp

PHP remote file inclusion vulnerability in footer.inc.php in PowerClan 1.14a and earlier, when register_globals is enabl

23RISCO

abrir ↗

Referência

CVE-2025-61884

CVE-2025-61884HIGHsob ataqueransomware

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions

100RISCO

abrir ↗

Referência

CVE-2024-10914

CVE-2024-10914CRITICAL

D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

85RISCO

abrir ↗

Referência

CVE-2019-9082

CVE-2019-9082HIGHsob ataque

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public/

100RISCO

abrir ↗

Referência

CVE-2023-27524

CVE-2023-27524HIGHsob ataque

Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

100RISCO

abrir ↗

Referência

CVE-2023-27524

CVE-2023-27524HIGHsob ataque

Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

100RISCO

abrir ↗

Referência✓ VexDay Proof

Uploader & Downloader 3.0 - 'id_user' SQL Injection

CVE-2006-6716—webappsphp

SQL injection vulnerability in administration/administre2.php in Eric GUILLAUME uploader&downloader 3 allows remote atta

23RISCO

abrir ↗

Referência✓ VexDay Proof

Bandwebsite 1.5 - 'LOGIN' Remote Add Admin

CVE-2006-6722—webappsphp

Bandwebsite (aka Bandsite portal system) 1.5 allows remote attackers to create administrative accounts via a direct requ

23RISCO

abrir ↗

Referência✓ VexDay Proof

Microsoft Windows - 'NetrWkstaUserEnum()' Remote Denial of Service

CVE-2006-6723—doswindows

The Workstation service in Microsoft Windows 2000 SP4 and XP SP2 allows remote attackers to cause a denial of service (m

35RISCO

abrir ↗

Referência✓ VexDay Proof

BolinTech DreamFTP Server 1.0.2 - 'PORT' Remote Denial of Service

CVE-2006-6724—doswindows

BolinTech Dream FTP Server 1.02 allows remote authenticated users, including anonymous users, to cause a denial of servi

23RISCO

abrir ↗

Referência✓ VexDay Proof

cwmVote 1.0 - 'archive.php' Remote File Inclusion

CVE-2006-6732—webappsphp

PHP remote file inclusion vulnerability in archive.php in cwmVote 1.0 allows remote attackers to execute arbitrary PHP c

23RISCO

abrir ↗

Referência

CVE-2019-0230

CVE-2019-0230—

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lea

60RISCO

abrir ↗

Referência

CVE-2019-0230

CVE-2019-0230—

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lea

60RISCO

abrir ↗

Referência✓ VexDay Proof

Paristemi 0.8.3b - 'buycd.php' Remote File Inclusion

CVE-2006-6739—webappsphp

PHP remote file inclusion vulnerability in buycd.php in Paristemi 0.8.3 allows remote attackers to execute arbitrary PHP

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.