Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.697exploits catalogados

36.715CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.475Referência 23.264GitHub PoC 15.172VulnCheck XDB 8.920Nuclei 4.373Metasploit 3.493✓ só verificadosrecentes populares risco

23.051 exploits

Referência

CVE-2018-16858

CVE-2018-16858HIGH

It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could

68RISCO

abrir ↗

Referência

CVE-2018-12613

CVE-2018-12613—

An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute

60RISCO

abrir ↗

Referência✓ VexDay Proof

WebCMS Portal Edition - 'id' Blind SQL Injection

CVE-2008-4185—webappsphp

SQL injection vulnerability in index.php in webCMS Portal Edition allows remote attackers to execute arbitrary SQL comma

23RISCO

abrir ↗

Referência✓ VexDay Proof

Harlandscripts Pro Traffic One - 'mypage.php' SQL Injection

CVE-2008-6213—webappsphp

SQL injection vulnerability in mypage.php in Harlandscripts Pro Traffic One allows remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência

CVE-2009-3058

CVE-2009-3058—

Stack-based buffer overflow in akPlayer 1.9.0 allows remote attackers to execute arbitrary code via a long string in a .

23RISCO

abrir ↗

Referência

CVE-2015-0802

CVE-2015-0802—

Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl

50RISCO

abrir ↗

Referência

CVE-2013-3628

CVE-2013-3628—

Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability

50RISCO

abrir ↗

Referência✓ VexDay Proof

Simple Document Management System 1.1.4 - Authentication Bypass

CVE-2008-6220—webappsphp

SQL injection vulnerability in login.php in Simple Document Management System (SDMS) 1.1.5 and 1.1.4, and possibly earli

23RISCO

abrir ↗

Referência

CVE-2008-4687

CVE-2008-4687—

manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort param

50RISCO

abrir ↗

Referência

CVE-2019-9881

CVE-2019-9881—

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on

43RISCO

abrir ↗

Referência

CVE-2019-9978

CVE-2019-9978MEDIUMsob ataque

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio

100RISCO

abrir ↗

Referência

CVE-2019-9978

CVE-2019-9978MEDIUMsob ataque

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio

100RISCO

abrir ↗

Referência✓ VexDay Proof

glFusion 1.1.2 - 'COM_applyFilter()/cookies' Blind SQL Injection

CVE-2009-1282—webappsphp

SQL injection vulnerability in private/system/lib-session.php in glFusion 1.1.2 and earlier allows remote attackers to e

23RISCO

abrir ↗

Referência

CVE-2012-6519

CVE-2012-6519—

SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL co

23RISCO

abrir ↗

Referência

CVE-2024-3552

CVE-2024-3552CRITICAL

Web Directory Free < 1.7.0 - Unauthenticated SQL Injection

75RISCO

abrir ↗

Referência

CVE-2015-7765

CVE-2015-7765—

ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser a

50RISCO

abrir ↗

Referência

CVE-2015-7765

CVE-2015-7765—

ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser a

50RISCO

abrir ↗

Referência

CVE-2013-3928

CVE-2013-3928—

Stack-based buffer overflow in the ReadFile function in flt_BMP.dll in Chasys Draw IES before 4.11.02 allows remote atta

50RISCO

abrir ↗

Referência

CVE-2012-6522

CVE-2012-6522—

Directory traversal vulnerability in the getContent function in codes/wcms.php in w-CMS 2.01 allows remote attackers to

23RISCO

abrir ↗

Referência

CVE-2021-36934

CVE-2021-36934HIGHsob ataque

Windows Elevation of Privilege Vulnerability

98RISCO

abrir ↗

Referência✓ VexDay Proof

Sitellite CMS 4.2.12 - '559668.php' Remote File Inclusion

CVE-2007-3228—webappsphp

PHP remote file inclusion vulnerability in saf/lib/PEAR/PhpDocumentor/Documentation/tests/bug-559668.php in Sitellite CM

35RISCO

abrir ↗

Referência

SugarCRM CE 6.3.1 - 'Unserialize()' PHP Code Execution

CVE-2012-0694—webappsphp

SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers

50RISCO

abrir ↗

Referência

CVE-2014-6593

CVE-2014-6593—

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.

50RISCO

abrir ↗

Referência

CVE-2018-8145

CVE-2018-8145—

An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could

35RISCO

abrir ↗

Referência

CVE-2025-25257

CVE-2025-25257CRITICALsob ataque

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi

100RISCO

abrir ↗

Referência

CVE-2019-9978

CVE-2019-9978MEDIUMsob ataque

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio

100RISCO

abrir ↗

Referência

CVE-2012-6524

CVE-2012-6524—

SQL injection vulnerability in kommentar.php in pGB 2.12 allows remote attackers to execute arbitrary SQL commands via t

23RISCO

abrir ↗

Referência

CVE-2015-0816

CVE-2015-0816—

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource

50RISCO

abrir ↗

Referência✓ VexDay Proof

Attachmax Dolphin 2.1.0 - Multiple Vulnerabilities

CVE-2008-4206—webappsphp

PHP remote file inclusion vulnerability in config.php in Attachmax Dolphin 2.1.0 and earlier, when register_globals is e

23RISCO

abrir ↗

Referência

CVE-2013-3928

CVE-2013-3928—

Stack-based buffer overflow in the ReadFile function in flt_BMP.dll in Chasys Draw IES before 4.11.02 allows remote atta

50RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.