Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.697exploits catalogados

36.715CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.475Referência 23.264GitHub PoC 15.172VulnCheck XDB 8.920Nuclei 4.373Metasploit 3.493✓ só verificadosrecentes populares risco

23.051 exploits

Referência✓ VexDay Proof

AdMan 1.1.20070907 - 'campaignId' SQL Injection

CVE-2008-6156—webappsphp

SQL injection vulnerability in editCampaign.php in AdMan 1.1.20070907 allows remote authenticated users to execute arbit

23RISCO

abrir ↗

Referência✓ VexDay Proof

Amaya 11.1 - W3C Editor/Browser 'defer' Remote Stack Overflow

CVE-2009-1209—remotewindows

Stack-based buffer overflow in W3C Amaya Web Browser 11.1 allows remote attackers to execute arbitrary code via a script

28RISCO

abrir ↗

Referência

CVE-2016-11021

CVE-2016-11021HIGHsob ataque

setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in th

98RISCO

abrir ↗

Referência

CVE-2009-2929

CVE-2009-2929—

Multiple SQL injection vulnerabilities in TGS Content Management 0.x allow remote attackers to execute arbitrary SQL com

23RISCO

abrir ↗

Referência

CVE-2017-11893

CVE-2017-11893—

ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execut

35RISCO

abrir ↗

Referência

CVE-2015-3628

CVE-2015-3628—

The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.

50RISCO

abrir ↗

Referência

CVE-2015-3628

CVE-2015-3628—

The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.

50RISCO

abrir ↗

Referência

CVE-2014-8799

CVE-2014-8799—

Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2

50RISCO

abrir ↗

Referência✓ VexDay Proof

ProArcadeScript 1.3 - 'random' SQL Injection

CVE-2008-4173—webappsphp

SQL injection vulnerability in ProArcadeScript 1.3 allows remote attackers to execute arbitrary SQL commands via the ran

23RISCO

abrir ↗

Referência

CVE-2019-9213

CVE-2019-9213—

In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which make

38RISCO

abrir ↗

Referência✓ VexDay Proof

Pre Real Estate Listings - 'search.php' SQL Injection

CVE-2008-4177—webappsphp

SQL injection vulnerability in search.php in Pre Real Estate Listings allows remote attackers to execute arbitrary SQL c

23RISCO

abrir ↗

Referência

CVE-2019-9213

CVE-2019-9213—

In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which make

38RISCO

abrir ↗

Referência

CVE-2015-7645

CVE-2015-7645HIGHsob ataqueransomware

Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535

83RISCO

abrir ↗

Referência

CVE-2015-7645

CVE-2015-7645HIGHsob ataqueransomware

Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535

83RISCO

abrir ↗

Referência

Bolt CMS 3.6.4 - Cross-Site Scripting

CVE-2019-9553—webappsphp

Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and

23RISCO

abrir ↗

Referência

CVE-2018-8355

CVE-2018-8355—

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft brow

35RISCO

abrir ↗

Referência

CVE-2017-12477

CVE-2017-12477—

It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xin

50RISCO

abrir ↗

Referência

Craft CMS 3.1.12 Pro - Cross-Site Scripting

CVE-2019-9554—webappsphp

In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHPVID 0.9.9 - 'categories_type.php' SQL Injection

CVE-2007-3610—webappsphp

SQL injection vulnerability in categories_type.php in phpVID 0.9.9 allows remote attackers to execute arbitrary SQL comm

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component RWCards 3.0.11 - Local File Inclusion

CVE-2008-6172—webappsphp

Directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla!

43RISCO

abrir ↗

Referência✓ VexDay Proof

pastelcms 0.8.0 - Local File Inclusion / SQL Injection

CVE-2009-1404—webappsphp

SQL injection vulnerability in admin.php in PastelCMS 0.8.0, when magic_quotes_gpc is disabled, allows remote attackers

23RISCO

abrir ↗

Referência

CVE-2017-6077

CVE-2017-6077CRITICALsob ataque

ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitra

90RISCO

abrir ↗

Referência

eBrigade ERP 4.5 - Arbitrary File Download

CVE-2019-9622—webappsphp

eBrigade through 4.5 allows Arbitrary File Download via ../ directory traversal in the showfile.php file parameter, as d

23RISCO

abrir ↗

Referência✓ VexDay Proof

Downline Goldmine newdownlinebuilder - SQL Injection

CVE-2008-4178—webappsphp

SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and D

23RISCO

abrir ↗

Referência

Core FTP Server FTP / SFTP Server v2 Build 674 - 'MDTM' Directory Traversal

CVE-2019-9649—doswindows

An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote att

28RISCO

abrir ↗

Referência

CVE-2009-3023

CVE-2009-3023—

Buffer overflow in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 6.0 allows remote authen

60RISCO

abrir ↗

Referência✓ VexDay Proof

Downline Goldmine paidversion - SQL Injection

CVE-2008-4178—webappsphp

SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and D

23RISCO

abrir ↗

Referência

CVE-2011-0654

CVE-2011-0654—

Integer underflow in the BowserWriteErrorLogEntry function in the Common Internet File System (CIFS) browser service in

50RISCO

abrir ↗

Referência

CVE-2017-11809

CVE-2017-11809—

ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker

35RISCO

abrir ↗

Referência

CVE-2019-9692

CVE-2019-9692—

class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard

50RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.