Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.724exploits catalogados

35.724CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.455Referência 22.492GitHub PoC 14.286VulnCheck XDB 8.703Nuclei 4.314Metasploit 3.474✓ só verificadosrecentes populares risco

22.429 exploits

Referência

CVE-2014-9350

CVE-2014-9350—

TP-Link TL-WR740N 4 with firmware 3.17.0 Build 140520, 3.16.6 Build 130529, and 3.16.4 Build 130205 allows remote attack

23RISCO

abrir ↗

Referência

CVE-2012-0292

CVE-2012-0292—

The awhost32 service in Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 (aka 12.

23RISCO

abrir ↗

Referência

CVE-2014-3418

CVE-2014-3418—

config/userAdmin/login.tdf in Infoblox NetMRI before 6.8.5 allows remote attackers to execute arbitrary commands via she

23RISCO

abrir ↗

Referência

CVE-2009-3356

CVE-2009-3356—

SQL injection vulnerability in index.php in Image voting 1.0 allows remote attackers to execute arbitrary SQL commands v

23RISCO

abrir ↗

Referência

CVE-2015-5533

CVE-2015-5533—

SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote

23RISCO

abrir ↗

Referência

CVE-2015-5533

CVE-2015-5533—

SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote

23RISCO

abrir ↗

Referência

CVE-2021-21276

CVE-2021-21276CRITICAL

Privilege escalation in Polr

48RISCO

abrir ↗

Referência✓ VexDay Proof

WordPress Core 2.1.2 - 'xmlrpc' SQL Injection

CVE-2007-1897—webappsphp

SQL injection vulnerability in xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated

23RISCO

abrir ↗

Referência

CVE-2016-15048

CVE-2016-15048CRITICAL

AMTT HiBOS Command Injection RCE via server_ping.php

48RISCO

abrir ↗

Referência

CVE-2022-24707

CVE-2022-24707HIGH

SQL injection in anuko timetracker

41RISCO

abrir ↗

Referência✓ VexDay Proof

WengoPhone 2.x - SIP Phone Remote Denial of Service

CVE-2007-4366—doswindows

WengoPhone 2.1 allows remote attackers to cause a denial of service (device crash) via a SIP INVITE message without a Co

23RISCO

abrir ↗

Referência

CVE-2010-4912

CVE-2010-4912—

SQL injection vulnerability in shop.php in UCenter Home 2.0 allows remote attackers to execute arbitrary SQL commands vi

23RISCO

abrir ↗

Referência

CVE-2010-4912

CVE-2010-4912—

SQL injection vulnerability in shop.php in UCenter Home 2.0 allows remote attackers to execute arbitrary SQL commands vi

23RISCO

abrir ↗

Referência✓ VexDay Proof

BosClassifieds 3.0 - 'index.php' SQL Injection

CVE-2008-1838—webappsphp

SQL injection vulnerability in BosClassifieds Classified Ads System 3.0 allows remote attackers to execute arbitrary SQL

23RISCO

abrir ↗

Referência

CVE-2013-3314

CVE-2013-3314—

The Loftek Nexus 543 IP Camera allows remote attackers to obtain (1) IP addresses via a request to get_realip.cgi or (2)

23RISCO

abrir ↗

Referência

CVE-2018-7706

CVE-2018-7706—

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbit

23RISCO

abrir ↗

Referência

CVE-2014-2630

CVE-2014-2630—

Unspecified vulnerability in HP Operations Agent 11.00, when Glance is used, allows local users to gain privileges via u

38RISCO

abrir ↗

Referência

CVE-2019-16399

CVE-2019-16399—

Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to acce

23RISCO

abrir ↗

Referência

CVE-2010-2130

CVE-2010-2130—

Cross-site scripting (XSS) vulnerability in wflogin.jsp in Aris Global ARISg 5.0 allows remote attackers to inject arbit

23RISCO

abrir ↗

Referência

CVE-2018-12617

CVE-2018-12617—

qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 h

28RISCO

abrir ↗

Referência

CVE-2019-14267

CVE-2019-14267—

PDFResurrect 0.15 has a buffer overflow via a crafted PDF file because data associated with startxref and %%EOF is misha

23RISCO

abrir ↗

Referência

CVE-2011-0403

CVE-2011-0403—

Untrusted search path vulnerability in ImgBurn.exe in ImgBurn 2.4.0.0, 2.5.4.0, and other versions allows local users, a

23RISCO

abrir ↗

Referência

CVE-2014-5521

CVE-2014-5521—

plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote authenticated users to execute arbitrary co

23RISCO

abrir ↗

Referência

CVE-2014-5521

CVE-2014-5521—

plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote authenticated users to execute arbitrary co

23RISCO

abrir ↗

Referência

CVE-2016-2203

CVE-2016-2203—

The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to discove

38RISCO

abrir ↗

Referência

CVE-2016-2203

CVE-2016-2203—

The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to discove

38RISCO

abrir ↗

Referência✓ VexDay Proof

ASPPortal 3.1.1 - 'downloadid' SQL Injection

CVE-2006-1353—webappsasp

Multiple SQL injection vulnerabilities in ASPPortal 3.1.1 and earlier allow remote attackers to execute arbitrary SQL co

23RISCO

abrir ↗

Referência✓ VexDay Proof

ViArt CMS/Shop/Helpdesk 3.3.2 - Remote File Inclusion

CVE-2007-6347—webappsphp

PHP remote file inclusion vulnerability in blocks/block_site_map.php in ViArt (1) CMS 3.3.2, (2) HelpDesk 3.3.2, (3) Sho

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component JoomlaXplorer 1.6.2 - Remote s

CVE-2008-1849—webappsphp

Directory traversal vulnerability in index.php in the joomlaXplorer (com_joomlaxplorer) Mambo/Joomla! component 1.6.2 an

23RISCO

abrir ↗

Referência

CVE-2015-7897

CVE-2015-7897—

The media scanning functionality in the face recognition library in android.media.process in Samsung Galaxy S6 Edge befo

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.