Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.772exploits catalogados

35.760CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.455Referência 22.523GitHub PoC 14.289VulnCheck XDB 8.710Nuclei 4.319Metasploit 3.476✓ só verificadosrecentes populares risco

22.523 exploits

Referência

CVE-2026-8983

CVE-2026-8983CRITICAL

Backdoor Authentication Token

48RISCO

abrir ↗

Referência

CVE-2026-16334

CVE-2026-16334MEDIUM

itsourcecode Hospital Management System prescriptionorder.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-16332

CVE-2026-16332MEDIUM

D-Link DNS-320 multi_uploadify.php unrestricted upload

33RISCO

abrir ↗

Referência

CVE-2026-13432

CVE-2026-13432MEDIUM

ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation

33RISCO

abrir ↗

Referência

CVE-2026-13156

CVE-2026-13156MEDIUM

MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF

33RISCO

abrir ↗

Referência

CVE-2026-12972

CVE-2026-12972MEDIUM

PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata Tampering

33RISCO

abrir ↗

Referência

CVE-2026-12898

CVE-2026-12898MEDIUM

All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal

33RISCO

abrir ↗

Referência

CVE-2026-16220

CVE-2026-16220MEDIUM

code-projects Online Examination System account.php cross site scripting

33RISCO

abrir ↗

Referência

CVE-2012-0393

CVE-2012-0393—

The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which

35RISCO

abrir ↗

Referência

CVE-2017-17595

CVE-2017-17595—

Beauty Parlour Booking Script 1.0 has SQL Injection via the /list gender or city parameter.

23RISCO

abrir ↗

Referência

CVE-2012-0394

CVE-2012-0394—

The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers

60RISCO

abrir ↗

Referência

CVE-2018-10077

CVE-2018-10077—

XML external entity (XXE) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to re

23RISCO

abrir ↗

Referência

CVE-2013-4743

CVE-2013-4743—

Static HTTP Server 1.0 has a Local Overflow

23RISCO

abrir ↗

Referência

CVE-2014-3791

CVE-2014-3791—

Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 6.8 allows remote attackers to execute arbitrary code

60RISCO

abrir ↗

Referência

CVE-2012-0394

CVE-2012-0394—

The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers

60RISCO

abrir ↗

Referência✓ VexDay Proof

FOSS Gallery Admin 1.0 - Arbitrary File Upload

CVE-2008-4509—webappsphp

Unrestricted file upload vulnerability in processFiles.php in FOSS Gallery Admin and FOSS Gallery Public 1.0 beta allows

23RISCO

abrir ↗

Referência✓ VexDay Proof

FOSS Gallery Public 1.0 - Arbitrary File Upload

CVE-2008-4509—webappsphp

Unrestricted file upload vulnerability in processFiles.php in FOSS Gallery Admin and FOSS Gallery Public 1.0 beta allows

23RISCO

abrir ↗

Referência✓ VexDay Proof

Konqueror 3.5.9 - 'font color' Remote Crash

CVE-2008-4514—doslinux

The HTML parser in KDE Konqueror 3.5.9 allows remote attackers to cause a denial of service (application crash) via a fo

23RISCO

abrir ↗

Referência

CVE-2017-17607

CVE-2017-17607—

CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail.

23RISCO

abrir ↗

Referência

CVE-2017-17607

CVE-2017-17607—

CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail.

23RISCO

abrir ↗

Referência

CVE-2014-3792

CVE-2014-3792—

Cross-site request forgery (CSRF) vulnerability in Beetel 450TC2 Router with firmware TX6-0Q-005_retail allows remote at

23RISCO

abrir ↗

Referência

CVE-2015-2805

CVE-2015-2805—

Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the management web int

23RISCO

abrir ↗

Referência

CVE-2015-2805

CVE-2015-2805—

Cross-site request forgery (CSRF) vulnerability in sec/content/sec_asa_users_local_db_add.html in the management web int

23RISCO

abrir ↗

Referência

CVE-2010-0605

CVE-2010-0605—

SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users, with "Sta

23RISCO

abrir ↗

Referência

CVE-2010-0605

CVE-2010-0605—

SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users, with "Sta

23RISCO

abrir ↗

Referência

CVE-2010-1873

CVE-2010-1873—

SQL injection vulnerability in the Jvehicles (com_jvehicles) component 1.0, 2.0, and 2.1111 for Joomla! allows remote at

23RISCO

abrir ↗

Referência

CVE-2010-1873

CVE-2010-1873—

SQL injection vulnerability in the Jvehicles (com_jvehicles) component 1.0, 2.0, and 2.1111 for Joomla! allows remote at

23RISCO

abrir ↗

Referência

CVE-2009-4360

CVE-2009-4360—

SQL injection vulnerability in modules/content/index.php in the Content module 0.5 for XOOPS allows remote attackers to

23RISCO

abrir ↗

Referência

CVE-2018-8134

CVE-2018-8134—

An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows

23RISCO

abrir ↗

Referência

CVE-2017-8685

CVE-2017-8685—

Windows GDI+ on Microsoft Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows information disclosure by the way

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.