Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.772exploits catalogados

35.760CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.455Referência 22.523GitHub PoC 14.289VulnCheck XDB 8.710Nuclei 4.319Metasploit 3.476✓ só verificadosrecentes populares risco

22.523 exploits

Referência✓ VexDay Proof

AllMyGuests 0.3.0 - 'AMG_serverpath' Remote File Inclusion

CVE-2007-0172—webappsphp

Multiple PHP remote file inclusion vulnerabilities in AllMyGuests 0.3.0 and earlier allow remote attackers to execute ar

23RISCO

abrir ↗

Referência✓ VexDay Proof

Gravity Board X 2.0 Beta - SQL Injection / Cross-Site Scripting

CVE-2008-2997—webappsphp

Cross-site scripting (XSS) vulnerability in index.php in Gravity Board X (GBX) 2.0 Beta allows remote attackers to injec

23RISCO

abrir ↗

Referência✓ VexDay Proof

Foxmail 5.0 - 'PunyLib.dll' Remote Stack Overflow

CVE-2004-2719—remotewindows

Buffer overflow in the UrlToLocal function in PunyLib.dll of Foxmail 5.0.300 allows remote attackers to execute arbitrar

23RISCO

abrir ↗

Referência

CVE-2021-42325

CVE-2021-42325—

Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.

28RISCO

abrir ↗

Referência

CVE-2010-1296

CVE-2010-1296—

Multiple buffer overflows in Adobe Photoshop CS4 before 11.0.2 allow user-assisted remote attackers to execute arbitrary

28RISCO

abrir ↗

Referência

CVE-2017-8490

CVE-2017-8490—

The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,

23RISCO

abrir ↗

Referência

CVE-2026-18615

CVE-2026-18615CRITICAL

GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injection

48RISCO

abrir ↗

Referência

CVE-2018-5315

CVE-2018-5315—

The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.

23RISCO

abrir ↗

Referência

CVE-2018-5315

CVE-2018-5315—

The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.

23RISCO

abrir ↗

Referência

CVE-2015-3314

CVE-2015-3314—

SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.

23RISCO

abrir ↗

Referência

CVE-2015-3314

CVE-2015-3314—

SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.

23RISCO

abrir ↗

Referência

CVE-2013-4092

CVE-2013-4092—

The SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 allows context-dependent att

23RISCO

abrir ↗

Referência

CVE-2016-1247

CVE-2016-1247—

The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS

23RISCO

abrir ↗

Referência

CVE-2016-1247

CVE-2016-1247—

The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS

23RISCO

abrir ↗

Referência

CVE-2014-2559

CVE-2014-2559—

Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPre

23RISCO

abrir ↗

Referência

CVE-2012-3414

CVE-2012-3414—

Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before

23RISCO

abrir ↗

Referência

CVE-2021-47964

CVE-2021-47964HIGH

Schlix CMS 2.2.6-6 Remote Code Execution via core.blockmanager

41RISCO

abrir ↗

Referência

CVE-2014-9412

CVE-2014-9412—

Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers

23RISCO

abrir ↗

Referência✓ VexDay Proof

East Wind Software - 'advdaudio.ocx 1.5.1.1' Local Buffer Overflow

CVE-2007-2576—localwindows

Buffer overflow in the East Wind Software advdaudio.ocx 1.5.1.1 ActiveX control allows user-assisted remote attackers to

23RISCO

abrir ↗

Referência✓ VexDay Proof

March Networks DVR 3204 - Logfile Information Disclosure

CVE-2007-6638—remotehardware

March Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows r

28RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component beamospetition - SQL Injection

CVE-2008-3132—webappsphp

SQL injection vulnerability in the beamospetition (com_beamospetition) component for Joomla! allows remote attackers to

23RISCO

abrir ↗

Referência✓ VexDay Proof

BareNuked CMS 1.1.0 - Arbitrary Add Admin

CVE-2008-3133—webappsphp

SQL injection vulnerability in admin/index.php in BareNuked CMS 1.1.0, when magic_quotes_gpc is disabled, allows remote

23RISCO

abrir ↗

Referência

CVE-2009-2852

CVE-2009-2852—

WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbi

23RISCO

abrir ↗

Referência

CVE-2010-2349

CVE-2010-2349—

H264WebCam 3.7 allows remote attackers to cause a denial of service (crash) via a long URI in a GET request, which trigg

23RISCO

abrir ↗

Referência

CVE-2009-3574

CVE-2009-3574—

Tuniac 090517c allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a lon

23RISCO

abrir ↗

Referência

CVE-2018-16071

CVE-2018-16071—

A use after free in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap

23RISCO

abrir ↗

Referência

CVE-2010-4170

CVE-2010-4170—

The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allow

38RISCO

abrir ↗

Referência

CVE-2010-4170

CVE-2010-4170—

The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allow

38RISCO

abrir ↗

Referência

CVE-2022-4447

CVE-2022-4447CRITICAL

Fontsy <= 1.8.6 - Multiple Unauthenticated SQLi

63RISCO

abrir ↗

Referência

CVE-2017-0299

CVE-2017-0299—

The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.