Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.449exploits catalogados

35.552CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.451Referência 22.367GitHub PoC 14.225VulnCheck XDB 8.649Nuclei 4.283Metasploit 3.474✓ só verificadosrecentes populares risco

22.332 exploits

Referência

CVE-2011-5173

CVE-2011-5173—

Buffer overflow in Bugbear Entertainment FlatOut 2005 allows user-assisted remote attackers to cause a denial of service

23RISCO

abrir ↗

Referência

CVE-2026-19899

CVE-2026-19899MEDIUM

SourceCodester Class and Exam Timetabling System edit_teacher.php sql injection

30RISCO

abrir ↗

Referência✓ VexDay Proof

CodeAvalanche Directory - Database Disclosure

CVE-2008-5898—webappsasp

CodeAvalanche Directory stores sensitive information under the web root with insufficient access control, which allows r

23RISCO

abrir ↗

Referência✓ VexDay Proof

CodeAvalanche FreeForAll - Database Disclosure

CVE-2008-5899—webappsasp

CodeAvalanche FreeForAll stores sensitive information under the web root with insufficient access control, which allows

23RISCO

abrir ↗

Referência✓ VexDay Proof

CodeAvalanche Articles - Database Disclosure

CVE-2008-5900—webappsasp

CodeAvalanche Articles stores sensitive information under the web root with insufficient access control, which allows re

23RISCO

abrir ↗

Referência

CVE-2022-43769

CVE-2022-43769HIGHsob ataque

Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

100RISCO

abrir ↗

Referência✓ VexDay Proof

Active Test 2.1 - Authentication Bypass

CVE-2008-5959—webappsasp

Multiple SQL injection vulnerabilities in start.asp in Active Test 2.1 allow remote attackers to execute arbitrary SQL c

23RISCO

abrir ↗

Referência

CVE-2026-18216

CVE-2026-18216—

Backup Migration < 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-Login

23RISCO

abrir ↗

Referência

CVE-2026-16611

CVE-2026-16611—

Product Feed PRO for WooCommerce < 13.5.7 - Unauthenticated Feed Configuration Disclosure

23RISCO

abrir ↗

Referência✓ VexDay Proof

Gravity GTD 0.4.5 - Local File Inclusion / Remote Code Execution

CVE-2008-5962—webappsphp

Directory traversal vulnerability in library/setup/rpc.php in Gravity Getting Things Done (GTD) 0.4.5 and earlier allows

23RISCO

abrir ↗

Referência

CVE-2026-16541

CVE-2026-16541—

Simply Schedule Appointments < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST Endpoints

23RISCO

abrir ↗

Referência

CVE-2026-14230

CVE-2026-14230—

ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings

23RISCO

abrir ↗

Referência

EasyNas 1.1.0 - OS Command Injection

CVE-2023-0830MEDIUMremotehardware

EasyNAS backup.pl system os command injection

38RISCO

abrir ↗

Referência

CVE-2019-18818

CVE-2019-18818—

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s

60RISCO

abrir ↗

Referência✓ VexDay Proof

LokiCMS 0.3.4 - 'index.php' Arbitrary Check File

CVE-2008-5965—webappsphp

Directory traversal vulnerability in index.php in LokiCMS 0.3.4 and earlier, when magic_quotes_gpc is disabled, allows r

23RISCO

abrir ↗

Referência

CVE-2023-0902

CVE-2023-0902LOW

SourceCodester Simple Food Ordering System process_order.php cross site scripting

28RISCO

abrir ↗

Referência

CVE-2025-61884

CVE-2025-61884HIGHsob ataqueransomware

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions

100RISCO

abrir ↗

Referência

CVE-2026-14229

CVE-2026-14229—

ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload

23RISCO

abrir ↗

Referência

CVE-2026-16007

CVE-2026-16007HIGH

Authenticated SQL Injection in AppFlowy

41RISCO

abrir ↗

Referência✓ VexDay Proof

PHP iCalendar 2.24 - 'cookie_language' Local File Inclusion / Arbitrary File Upload

CVE-2008-5967—webappsphp

admin/index.php in PHP iCalendar 2.3.4, 2.24, and earlier does not require administrative authentication for an addupdat

23RISCO

abrir ↗

Referência✓ VexDay Proof

Ocean12 Mailing List Manager Gold - File Disclosure / SQL Injection / Cross-Site Scripting

CVE-2008-5978—webappsphp

Multiple SQL injection vulnerabilities in Ocean12 Mailing List Manager Gold allow remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência

CVE-2023-0912

CVE-2023-0912MEDIUM

SourceCodester Auto Dealer Management System sql injection

33RISCO

abrir ↗

Referência✓ VexDay Proof

Jetik Emlak ESA 2.0 - Multiple SQL Injections

CVE-2008-5992—webappsphp

Multiple SQL injection vulnerabilities in Jetik Emlak Sistem A (ESA) 2.0 allow remote attackers to execute arbitrary SQL

23RISCO

abrir ↗

Referência✓ VexDay Proof

I-Rater Basic - SQL Injection

CVE-2008-6017—webappsphp

SQL injection vulnerability in messages.php in I-Rater Basic allows remote attackers to execute arbitrary SQL commands v

23RISCO

abrir ↗

Referência

CVE-2019-0230

CVE-2019-0230—

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lea

60RISCO

abrir ↗

Referência

CVE-2019-0230

CVE-2019-0230—

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lea

60RISCO

abrir ↗

Referência

CVE-2026-19812

CVE-2026-19812HIGH

TOTOLINK A800R product.so cstecgi.cgi UploadCustomModule stack-based overflow

41RISCO

abrir ↗

Referência✓ VexDay Proof

Uploader & Downloader 3.0 - 'id_user' SQL Injection

CVE-2006-6716—webappsphp

SQL injection vulnerability in administration/administre2.php in Eric GUILLAUME uploader&downloader 3 allows remote atta

23RISCO

abrir ↗

Referência

CVE-2026-19811

CVE-2026-19811HIGH

TOTOLINK A800R firewall.so cstecgi.cgi setIpQosRules stack-based overflow

41RISCO

abrir ↗

Referência

CVE-2026-18039

CVE-2026-18039HIGH

Essential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment

41RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.