Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.449exploits catalogados

35.552CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.451Referência 22.367GitHub PoC 14.225VulnCheck XDB 8.649Nuclei 4.283Metasploit 3.474✓ só verificadosrecentes populares risco

22.332 exploits

Referência

eBrigade ERP 4.5 - Arbitrary File Download

CVE-2019-9622—webappsphp

eBrigade through 4.5 allows Arbitrary File Download via ../ directory traversal in the showfile.php file parameter, as d

23RISCO

abrir ↗

Referência

CVE-2019-9670

CVE-2019-9670CRITICALsob ataque

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XX

100RISCO

abrir ↗

Referência

CVE-2019-9670

CVE-2019-9670CRITICALsob ataque

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XX

100RISCO

abrir ↗

Referência

CVE-2026-14300

CVE-2026-14300HIGH

miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover

41RISCO

abrir ↗

Referência

CVE-2026-14234

CVE-2026-14234HIGH

WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF

41RISCO

abrir ↗

Referência

CVE-2026-14224

CVE-2026-14224MEDIUM

Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR

33RISCO

abrir ↗

Referência

CVE-2026-13692

CVE-2026-13692MEDIUM

PayU CommercePro < 3.9.0 - Unauthenticated Order Tampering

33RISCO

abrir ↗

Referência

CVE-2019-9881

CVE-2019-9881—

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on

43RISCO

abrir ↗

Referência

CVE-2019-9978

CVE-2019-9978MEDIUMsob ataque

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio

100RISCO

abrir ↗

Referência

CVE-2020-0009

CVE-2020-0009—

In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This

23RISCO

abrir ↗

Referência

CVE-2018-25342

CVE-2018-25342HIGH

Smartshop 1 SQL Injection via search.php

41RISCO

abrir ↗

Referência

CVE-2018-25341

CVE-2018-25341HIGH

Smartshop 1 SQL Injection via product.php id Parameter

41RISCO

abrir ↗

Referência

CVE-2021-47955

CVE-2021-47955MEDIUM

CouchCMS 2.2.1 Cross-Site Scripting via SVG File Upload

33RISCO

abrir ↗

Referência

CVE-2021-47954

CVE-2021-47954HIGH

LayerBB 1.1.4 SQL Injection via search_query Parameter

41RISCO

abrir ↗

Referência

CVE-2020-37228

CVE-2020-37228CRITICAL

iDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security Bypass

48RISCO

abrir ↗

Referência

CVE-2020-37227

CVE-2020-37227HIGH

WordPress Plugin HS Brand Logo Slider 2.1 Unrestricted File Upload

41RISCO

abrir ↗

Referência

CVE-2018-25336

CVE-2018-25336MEDIUM

jCart for OpenCart 2.3.0.2 Cross-Site Request Forgery

33RISCO

abrir ↗

Referência

CVE-2018-25335

CVE-2018-25335CRITICAL

WordPress Plugin Peugeot Music 1.0 Arbitrary File Upload

48RISCO

abrir ↗

Referência

CVE-2018-25333

CVE-2018-25333HIGH

Nordex N149/4.0-4.5 Wind Turbine Web Server SQL Injection

41RISCO

abrir ↗

Referência

CVE-2018-25332

CVE-2018-25332CRITICAL

GitBucket 4.23.1 Unauthenticated Remote Code Execution

48RISCO

abrir ↗

Referência

CVE-2018-25331

CVE-2018-25331MEDIUM

Zenar Content Management System Cross-Site Scripting via ajax.php

33RISCO

abrir ↗

Referência

CVE-2018-25330

CVE-2018-25330HIGH

Joomla! EkRishta 2.10 Persistent XSS and SQL Injection

41RISCO

abrir ↗

Referência

CVE-2018-25329

CVE-2018-25329HIGH

WordPress Plugin WP with Spritz 1.0 Remote File Inclusion

41RISCO

abrir ↗

Referência

CVE-2020-10220

CVE-2020-10220—

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php

60RISCO

abrir ↗

Referência

CVE-2020-10220

CVE-2020-10220—

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php

60RISCO

abrir ↗

Referência

CVE-2020-10220

CVE-2020-10220—

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php

60RISCO

abrir ↗

Referência

CVE-2026-66731

CVE-2026-66731HIGH

facil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS

41RISCO

abrir ↗

Referência

CVE-2026-66730

CVE-2026-66730HIGH

facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser

41RISCO

abrir ↗

Referência

CVE-2026-66729

CVE-2026-66729HIGH

facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser

41RISCO

abrir ↗

Referência

CVE-2025-9486

CVE-2025-9486LOW

Incorrect Privilege Assignment in GitLab

28RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.