Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.620exploits catalogados

35.647CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.455Referência 22.429GitHub PoC 14.270VulnCheck XDB 8.693Nuclei 4.299Metasploit 3.474✓ só verificadosrecentes populares risco

22.429 exploits

Referência

CVE-2016-4806

CVE-2016-4806—

Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows a malicious intended u

28RISCO

abrir ↗

Referência

CVE-2010-2917

CVE-2010-2917—

Multiple cross-site scripting (XSS) vulnerabilities in index.php in AJ Square AJ Article 3.0 allow remote attackers to i

23RISCO

abrir ↗

Referência

CVE-2009-4940

CVE-2009-4940—

SQL injection vulnerability in index.php in Zeus Cart 2.3 and earlier allows remote attackers to execute arbitrary SQL c

23RISCO

abrir ↗

Referência

CVE-2014-10011

CVE-2014-10011—

Stack-based buffer overflow in UltraCamLib in the UltraCam ActiveX Control (UltraCamX.ocx) for the TRENDnet SecurView ca

28RISCO

abrir ↗

Referência

CVE-2021-33904

CVE-2021-33904—

In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. NOTE: The

38RISCO

abrir ↗

Referência

CVE-2013-6231

CVE-2013-6231—

SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script

23RISCO

abrir ↗

Referência

CVE-2022-23626

CVE-2022-23626HIGH

Insufficient file checks in m1k1o/blog

41RISCO

abrir ↗

Referência

CVE-2011-0708

CVE-2011-0708—

exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms performs an incorrect cast, which allows remote att

23RISCO

abrir ↗

Referência

CVE-2013-10037

CVE-2013-10037CRITICAL

WebTester 5.x install2.php Unauthenticated Command Execution

63RISCO

abrir ↗

Referência

CVE-2013-10037

CVE-2013-10037CRITICAL

WebTester 5.x install2.php Unauthenticated Command Execution

63RISCO

abrir ↗

Referência

CVE-2019-11932

CVE-2019-11932—

A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version

35RISCO

abrir ↗

Referência

CVE-2019-11932

CVE-2019-11932—

A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version

35RISCO

abrir ↗

Referência

CVE-2019-11374

CVE-2019-11374—

74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.

23RISCO

abrir ↗

Referência

CVE-2019-11374

CVE-2019-11374—

74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.

23RISCO

abrir ↗

Referência

CVE-2020-25557

CVE-2020-25557—

In CMSuno 1.6.2, an attacker can inject malicious PHP code as a "username" while changing his/her username & password. A

23RISCO

abrir ↗

Referência

CVE-2020-25538

CVE-2020-25538—

An authenticated attacker can inject malicious code into "lang" parameter in /uno/central.php file in CMSuno 1.6.2 and r

23RISCO

abrir ↗

Referência

CVE-2011-4876

CVE-2011-4876—

Directory traversal vulnerability in HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008;

23RISCO

abrir ↗

Referência

CVE-2009-4623

CVE-2009-4623—

Multiple PHP remote file inclusion vulnerabilities in Advanced Comment System 1.0 allow remote attackers to execute arbi

23RISCO

abrir ↗

Referência✓ VexDay Proof

The Merchant 2.2.0 - 'index.php?show' Remote File Inclusion

CVE-2007-2424—webappsphp

PHP remote file inclusion vulnerability in help/index.php in The Merchant (themerchant) 2.2 allows remote attackers to e

23RISCO

abrir ↗

Referência

CVE-2016-4535

CVE-2016-4535—

Integer signedness error in the AV engine before DAT 8145, as used in McAfee LiveSafe 14.0, allows remote attackers to c

23RISCO

abrir ↗

Referência

CVE-2016-4535

CVE-2016-4535—

Integer signedness error in the AV engine before DAT 8145, as used in McAfee LiveSafe 14.0, allows remote attackers to c

23RISCO

abrir ↗

Referência

CVE-2014-4663

CVE-2014-4663—

TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary

23RISCO

abrir ↗

Referência

CVE-2014-2647

CVE-2014-2647—

Cross-site scripting (XSS) vulnerability in HP Operations Agent in HP Operations Manager (formerly OpenView Communicatio

23RISCO

abrir ↗

Referência

CVE-2010-0279

CVE-2010-0279—

Unrestricted file upload vulnerability in upload.php in BTS-GI Read excel 1.1 allows remote attackers to execute arbitra

23RISCO

abrir ↗

Referência✓ VexDay Proof

WordPress Plugin Sniplets 1.1.2 - Remote File Inclusion / Cross-Site Scripting / Remote Code Execution

CVE-2008-1061—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote at

38RISCO

abrir ↗

Referência

CVE-2018-16299

CVE-2018-16299—

The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.

50RISCO

abrir ↗

Referência

CVE-2018-16299

CVE-2018-16299—

The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.

50RISCO

abrir ↗

Referência✓ VexDay Proof

Najdi.si Toolbar - ActiveX Remote Buffer Overflow (PoC)

CVE-2008-7103—doswindows

Stack-based buffer overflow in an ActiveX control in najdisitoolbar.dll in Najdi.si Toolbar 2.0.4.1 allows remote attack

23RISCO

abrir ↗

Referência

CVE-2021-40352

CVE-2021-40352—

OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can re

23RISCO

abrir ↗

Referência

CVE-2009-3058

CVE-2009-3058—

Stack-based buffer overflow in akPlayer 1.9.0 allows remote attackers to execute arbitrary code via a long string in a .

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.