Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.813exploits catalogados

35.788CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.455Referência 22.549GitHub PoC 14.290VulnCheck XDB 8.722Nuclei 4.320Metasploit 3.477✓ só verificadosrecentes populares risco

22.549 exploits

Referência

CVE-2021-43062

CVE-2021-43062MEDIUM

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0

53RISCO

abrir ↗

Referência

CVE-2017-5799

CVE-2017-5799—

A Remote Code Execution vulnerability in HPE OpenCall Media Platform (OCMP) was found. The vulnerability impacts OCMP ve

28RISCO

abrir ↗

Referência

CVE-2018-1821

CVE-2018-1821HIGH

IBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External Entity Injection (XXE) a

46RISCO

abrir ↗

Referência

CVE-2010-4719

CVE-2010-4719—

Directory traversal vulnerability in JRadio (com_jradio) component before 1.5.1 for Joomla! allows remote attackers to r

43RISCO

abrir ↗

Referência

CVE-2010-4719

CVE-2010-4719—

Directory traversal vulnerability in JRadio (com_jradio) component before 1.5.1 for Joomla! allows remote attackers to r

43RISCO

abrir ↗

Referência✓ VexDay Proof

PHPBB2 MODificat 0.2.0 - 'functions.php' Remote File Inclusion

CVE-2007-0656—webappsphp

PHP remote file inclusion vulnerability in includes/functions.php in phpBB2-MODificat 0.2.0 and earlier allows remote at

28RISCO

abrir ↗

Referência

CVE-2018-8139

CVE-2018-8139—

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft

35RISCO

abrir ↗

Referência

CVE-2017-12965

CVE-2017-12965—

Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID pa

28RISCO

abrir ↗

Referência

CVE-2015-8352

CVE-2015-8352—

Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files

28RISCO

abrir ↗

Referência

CVE-2019-3778

CVE-2019-3778—

Open Redirect in spring-security-oauth2

28RISCO

abrir ↗

Referência

CVE-2013-7051

CVE-2013-7051—

D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters

28RISCO

abrir ↗

Referência

CVE-2018-0491

CVE-2018-0491—

A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of se

28RISCO

abrir ↗

Referência

CVE-2020-25790

CVE-2020-25790—

Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archi

28RISCO

abrir ↗

Referência

CVE-2020-25790

CVE-2020-25790—

Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archi

28RISCO

abrir ↗

Referência

CVE-2016-0793

CVE-2016-0793—

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Se

28RISCO

abrir ↗

Referência✓ VexDay Proof

FaScript FaName 1.0 - SQL Injection

CVE-2008-0328—webappsphp

SQL injection vulnerability in page.php in FaScript FaName 1.0 allows remote attackers to execute arbitrary SQL commands

23RISCO

abrir ↗

Referência

CVE-2025-44823

CVE-2025-44823CRITICAL

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagi

53RISCO

abrir ↗

Referência

CVE-2015-2049

CVE-2015-2049—

Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated use

50RISCO

abrir ↗

Referência

CVE-2017-6554

CVE-2017-6554—

pmmasterd in Quest Privilege Manager before 6.0.0.061, when configured as a policy server, allows remote attackers to wr

28RISCO

abrir ↗

Referência

CVE-2020-35729

CVE-2020-35729—

KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.

60RISCO

abrir ↗

Referência

CVE-2018-8469

CVE-2018-8469—

An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppCont

28RISCO

abrir ↗

Referência

CVE-2018-8463

CVE-2018-8463—

An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppCont

28RISCO

abrir ↗

Referência

CVE-2018-20220

CVE-2018-20220—

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authen

28RISCO

abrir ↗

Referência✓ VexDay Proof

PHP-RESIDENCE 0.7.2 - 'Search' SQL Injection

CVE-2008-0353—webappsphp

SQL injection vulnerability in visualizza_tabelle.php in php-residence 0.7.2 and 1.0 allows remote attackers to execute

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component ClickHeat 1.0.1 - Multiple Remote File Inclusions

CVE-2008-5793—webappsphp

Multiple PHP remote file inclusion vulnerabilities in the Clickheat - Heatmap stats (com_clickheat) component 1.0.1 for

28RISCO

abrir ↗

Referência

CVE-2009-2604

CVE-2009-2604—

Multiple SQL injection vulnerabilities in adminlogin.asp in Zen Help Desk 2.1 allow remote attackers to execute arbitrar

23RISCO

abrir ↗

Referência

CVE-2018-0934

CVE-2018-0934—

ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution,

35RISCO

abrir ↗

Referência

CVE-2009-3170

CVE-2009-3170—

Stack-based buffer overflow in AIMP2 Audio Converter 2.53 (build 330) and earlier allows remote attackers to cause a den

28RISCO

abrir ↗

Referência

CVE-2012-6429

CVE-2012-6429—

Buffer overflow in the PrepareSync method in the SyncService.dll ActiveX control in Samsung Kies before 2.5.1.12123_2_7

28RISCO

abrir ↗

Referência

CVE-2012-4886

CVE-2012-4886—

Stack-based buffer overflow in wpsio.dll in Kingsoft WPS Office 2012 possibly 8.1.0.3238 allows remote attackers to exec

28RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.