Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.772exploits catalogados

35.760CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.455Referência 22.523GitHub PoC 14.289VulnCheck XDB 8.710Nuclei 4.319Metasploit 3.476✓ só verificadosrecentes populares risco

22.523 exploits

Referência

CVE-2018-17182

CVE-2018-17182—

An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles

23RISCO

abrir ↗

Referência

CVE-2021-27964

CVE-2021-27964—

SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Con

50RISCO

abrir ↗

Referência✓ VexDay Proof

b1gbb 2.24.0 - SQL Injection / Cross-Site Scripting

CVE-2007-3590—webappsphp

Cross-site scripting (XSS) vulnerability in visitenkarte.php in b1gBB 2.24.0 allows remote attackers to inject arbitrary

23RISCO

abrir ↗

Referência

CVE-2009-3597

CVE-2009-3597—

Digitaldesign CMS 0.1 stores sensitive information under the web root with insufficient access control, which allows rem

23RISCO

abrir ↗

Referência

CVE-2012-4362

CVE-2012-4362—

hydra.exe in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance has a hardcoded password of L0CAlu53R for the global$a

23RISCO

abrir ↗

Referência

CVE-2012-4362

CVE-2012-4362—

hydra.exe in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance has a hardcoded password of L0CAlu53R for the global$a

23RISCO

abrir ↗

Referência

CVE-2023-38951

CVE-2023-38951CRITICAL

ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arb

48RISCO

abrir ↗

Referência

CVE-2007-1524

CVE-2007-1524—

Directory traversal vulnerability in themes/default/ in ZomPlog 3.7.6 and earlier allows remote attackers to include arb

23RISCO

abrir ↗

Referência

CVE-2013-6233

CVE-2013-6233—

Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web

23RISCO

abrir ↗

Referência

CVE-2013-6233

CVE-2013-6233—

Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web

23RISCO

abrir ↗

Referência

CVE-2011-5012

CVE-2011-5012—

Heap-based buffer overflow in the Reflection FTP Client (rftpcom.dll 7.2.0.106 and possibly other versions), as used in

23RISCO

abrir ↗

Referência

CVE-2014-2962

CVE-2014-2962—

Absolute path traversal vulnerability in the webproc cgi module on the Belkin N150 F9K1009 v1 router with firmware befor

50RISCO

abrir ↗

Referência✓ VexDay Proof

PHP-Ring Webring System 0.9.1 - Insecure Cookie Handling

CVE-2008-3602—webappsphp

admin/wr_admin.php in PHP-Ring Webring System (aka uPHP_ring_website) 0.9.1 allows remote attackers to bypass authentica

23RISCO

abrir ↗

Referência

CVE-2012-10059

CVE-2012-10059CRITICAL

Dolibarr ERP/CRM Post-Auth OS Command Injection

63RISCO

abrir ↗

Referência

CVE-2012-10059

CVE-2012-10059CRITICAL

Dolibarr ERP/CRM Post-Auth OS Command Injection

63RISCO

abrir ↗

Referência

CVE-2012-10059

CVE-2012-10059CRITICAL

Dolibarr ERP/CRM Post-Auth OS Command Injection

63RISCO

abrir ↗

Referência

CVE-2018-0880

CVE-2018-0880—

The Desktop Bridge in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an el

23RISCO

abrir ↗

Referência

CVE-2011-5040

CVE-2011-5040—

Multiple cross-site scripting (XSS) vulnerabilities in Infoproject Biznis Heroj allow remote attackers to inject arbitra

23RISCO

abrir ↗

Referência

CVE-2025-35028

CVE-2025-35028CRITICAL

HexStrike AI MCP Server Command Injection

48RISCO

abrir ↗

Referência

CVE-2012-3524

CVE-2012-3524—

libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows

23RISCO

abrir ↗

Referência

CVE-2019-19032

CVE-2019-19032—

XMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is: Arbitrary File Read when an

23RISCO

abrir ↗

Referência✓ VexDay Proof

fresh email script 1.0 - Multiple Vulnerabilities

CVE-2008-7043—webappsphp

Cross-site scripting (XSS) vulnerability in register.php in FreshScripts Fresh Email Script 1.0 through 1.11 allows remo

23RISCO

abrir ↗

Referência✓ VexDay Proof

PPC Search Engine 1.61 - 'INC' Multiple Remote File Inclusions

CVE-2007-0167—webappsphp

Multiple PHP file inclusion vulnerabilities in WGS-PPC (aka PPC Search Engine), as distributed with other aliases, allow

28RISCO

abrir ↗

Referência

CVE-2018-13457

CVE-2018-13457—

qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to

23RISCO

abrir ↗

Referência

CVE-2014-1906

CVE-2014-1906—

Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5

23RISCO

abrir ↗

Referência✓ VexDay Proof

TorrentTrader Classic 1.09 - Multiple Vulnerabilities

CVE-2009-2158—webappsphp

account-recover.php in TorrentTrader Classic 1.09 chooses random passwords from an insufficiently large set, which makes

23RISCO

abrir ↗

Referência

CVE-2020-7680

CVE-2020-7680—

docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters a

23RISCO

abrir ↗

Referência

CVE-2020-7680

CVE-2020-7680—

docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters a

23RISCO

abrir ↗

Referência

CVE-2011-5033

CVE-2011-5033—

Stack-based buffer overflow in CFS.c in ConfigServer Security & Firewall (CSF) before 5.43, when running on a DirectAdmi

23RISCO

abrir ↗

Referência

CVE-2009-4092

CVE-2009-4092—

Cross-site request forgery (CSRF) vulnerability in user.php in Simplog 0.9.3.2, and possibly earlier, allows remote atta

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.