Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.449exploits catalogados
35.552CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.451Referência 22.367GitHub PoC 14.225VulnCheck XDB 8.649Nuclei 4.283Metasploit 3.474✓ só verificadosrecentespopularesrisco
22.367 exploits
Referência
CVE-2026-7669
CVE-2026-7669MEDIUM
sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection
33RISCO
abrir ↗
Referência
CVE-2026-7668
CVE-2026-7668MEDIUM
MikroTik RouterOS SCEP Endpoint scep.p ASN1_STRING_data out-of-bounds
33RISCO
abrir ↗
Referência
CVE-2026-7653
CVE-2026-7653MEDIUM
r-huijts mcp-server-rijksmuseum MCP index.ts open_image_in_browser os command injection
33RISCO
abrir ↗
Referência
CVE-2026-56122
CVE-2026-56122HIGH
Winstone Servlet Engine 0.9.10 Path Traversal via HTTP Request Paths
41RISCO
abrir ↗
Referência
CVE-2026-56121
CVE-2026-56121CRITICAL
Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization
48RISCO
abrir ↗
Referência
CVE-2026-56111
CVE-2026-56111HIGH
Marlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code Handler
41RISCO
abrir ↗
Referência✓ VexDay Proof
Prozilla Hosting Index - 'id' SQL Injection
CVE-2008-6115—webappsphp
SQL injection vulnerability in directory.php in Prozilla Hosting Index allows remote attackers to execute arbitrary SQL
23RISCO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component Thyme 1.0 - SQL Injection
CVE-2008-6116—webappsphp
SQL injection vulnerability in the EXtrovert Software Thyme (com_thyme) 1.0 component for Joomla! allows remote attacker
23RISCO
abrir ↗
Referência✓ VexDay Proof
WebBiscuits Modules Controller 1.1 - Remote File Inclusion / Remote File Disclosure
CVE-2008-6139—webappsphp
Directory traversal vulnerability in faqsupport/wce.download.php in WebBiscuits Modules Controller 1.1 allows remote att
23RISCO
abrir ↗
Referência
CVE-2026-7384
CVE-2026-7384MEDIUM
ezequiroga mcp-bases research_server.py search_papers path traversal
33RISCO
abrir ↗
Referência✓ VexDay Proof
OwenPoll 1.0 - Insecure Cookie Handling
CVE-2008-6143—webappsphp
OwenPoll 1.0 allows remote attackers to bypass authentication and obtain administrative access via a modified account na
23RISCO
abrir ↗
Referência✓ VexDay Proof
Enthrallweb emates 1.0 - 'newsdetail.asp' SQL Injection
CVE-2006-6806—webappsasp
SQL injection vulnerability in newsdetail.asp in Enthrallweb eMates 1.0 allows remote attackers to execute arbitrary SQL
23RISCO
abrir ↗
Referência✓ VexDay Proof
DeluxeBB 1.2 - Blind SQL Injection
CVE-2008-6146—webappsphp
SQL injection vulnerability in pm.php in DeluxeBB 1.2 and earlier, when magic_quotes_gpc is disabled, allows remote atta
23RISCO
abrir ↗
Referência✓ VexDay Proof
Ananda Real Estate 3.4 - 'agent' SQL Injection
CVE-2006-6807—webappsasp
SQL injection vulnerability in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 and earlier all
23RISCO
abrir ↗
Referência
CVE-2026-9815
CVE-2026-9815MEDIUM
MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCE
33RISCO
abrir ↗
Referência
CVE-2026-55200
CVE-2026-55200CRITICAL
libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
48RISCO
abrir ↗
Referência
CVE-2020-8260
CVE-2020-8260HIGHsob ataque
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform
100RISCO
abrir ↗
Referência
CVE-2020-11651
CVE-2020-11651CRITICALsob ataque
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs cla
100RISCO
abrir ↗
Referência
CVE-2020-11651
CVE-2020-11651CRITICALsob ataque
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs cla
100RISCO
abrir ↗
Referência
CVE-2008-7269
CVE-2008-7269—
Open redirect vulnerability in api.php in SiteEngine 5.x allows user-assisted remote attackers to redirect users to arbi
38RISCO
abrir ↗
Referência
CVE-2026-8037
CVE-2026-8037CRITICALsob ataque
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
100RISCO
abrir ↗
Referência
CVE-2026-10804
CVE-2026-10804LOW
Streamlit Palette hashing.py weak hash
28RISCO
abrir ↗
Referência
CVE-2026-10803
CVE-2026-10803LOW
MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hash
28RISCO
abrir ↗
Referência
CVE-2026-10802
CVE-2026-10802MEDIUM
keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption
33RISCO
abrir ↗
Referência
CVE-2026-10801
CVE-2026-10801LOW
modelscope ms-swift PIL Image Cache Key base.py Template._save_pil_image weak hash
28RISCO
abrir ↗
Referência
CVE-2026-10288
CVE-2026-10288MEDIUM
code-projects Hotel and Tourism Reservation System Admin Login login.php password_verify improper authentication
33RISCO
abrir ↗
Referência
CVE-2026-10286
CVE-2026-10286MEDIUM
CodeAstro Payroll System home_employee.php sql injection
33RISCO
abrir ↗
Referência
CVE-2026-7229
CVE-2026-7229MEDIUM
code-projects Coaching Management System POST reply.php sql injection
33RISCO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component Kbase 1.0 - SQL Injection
CVE-2008-6166—webappsphp
SQL injection vulnerability in the KBase (com_kbase) 1.2 component for Joomla! allows remote attackers to execute arbitr
23RISCO
abrir ↗
Referência✓ VexDay Proof
miniPortail 2.2 - Cross-Site Scripting / Local File Inclusion
CVE-2008-6167—webappsphp
Directory traversal vulnerability in search.php in miniPortail 2.2 and earlier allows remote attackers to include and ex
23RISCO
abrir ↗
← anteriorpágina 503 / 746próximo →

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.