Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.837exploits catalogados

35.811CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.455Referência 22.572GitHub PoC 14.291VulnCheck XDB 8.722Nuclei 4.320Metasploit 3.477✓ só verificadosrecentes populares risco

22.572 exploits

Referência

CVE-2018-15811

CVE-2018-15811HIGHsob ataque

DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

100RISCO

abrir ↗

Referência✓ VexDay Proof

PHP iCalendar 2.24 - Insecure Cookie Handling

CVE-2008-5840—webappsphp

PHP iCalendar 2.24 and earlier allows remote attackers to bypass authentication by setting the phpicalendar and phpicale

23RISCO

abrir ↗

Referência

CVE-2017-5715

CVE-2017-5715MEDIUM

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized discl

55RISCO

abrir ↗

Referência✓ VexDay Proof

MyPBS - 'seasonID' SQL Injection

CVE-2008-5851—webappsphp

SQL injection vulnerability in index.php in My PHP Baseball Stats (MyPBS) allows remote attackers to execute arbitrary S

23RISCO

abrir ↗

Referência✓ VexDay Proof

Emefa Guestbook 3.0 - Remote Database Disclosure

CVE-2008-5852—webappsasp

Emefa Guestbook 3.0 stores sensitive information under the web root with insufficient access control, which allows remot

23RISCO

abrir ↗

Referência✓ VexDay Proof

XGuestBook 2.0 - Authentication Bypass

CVE-2009-0810—webappsphp

SQL injection vulnerability in login.php in xGuestbook 2.0 allows remote attackers to execute arbitrary SQL commands via

23RISCO

abrir ↗

Referência

CVE-2018-6389

CVE-2018-6389—

In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the

45RISCO

abrir ↗

Referência✓ VexDay Proof

PlaySms 0.9.3 - Multiple Local/Remote File Inclusions

CVE-2008-5881—webappsphp

Multiple directory traversal vulnerabilities in playSMS 0.9.3 allow remote attackers to include and execute arbitrary lo

23RISCO

abrir ↗

Referência✓ VexDay Proof

clickandemail - SQL Injection / Cross-Site Scripting

CVE-2008-5892—webappsasp

Multiple SQL injection vulnerabilities in ClickAndEmail allow remote attackers to execute arbitrary SQL commands via (1)

23RISCO

abrir ↗

Referência✓ VexDay Proof

Mediatheka 4.2 - 'lang' Local File Inclusion

CVE-2008-5894—webappsphp

Directory traversal vulnerability in index.php in Mediatheka 4.2 allows remote attackers to include and execute arbitrar

23RISCO

abrir ↗

Referência✓ VexDay Proof

CodeAvalanche Directory - Database Disclosure

CVE-2008-5898—webappsasp

CodeAvalanche Directory stores sensitive information under the web root with insufficient access control, which allows r

23RISCO

abrir ↗

Referência✓ VexDay Proof

CodeAvalanche FreeForAll - Database Disclosure

CVE-2008-5899—webappsasp

CodeAvalanche FreeForAll stores sensitive information under the web root with insufficient access control, which allows

23RISCO

abrir ↗

Referência✓ VexDay Proof

CodeAvalanche Articles - Database Disclosure

CVE-2008-5900—webappsasp

CodeAvalanche Articles stores sensitive information under the web root with insufficient access control, which allows re

23RISCO

abrir ↗

Referência

CVE-2008-5904

CVE-2008-5904—

The rdp_rdp_process_color_pointer_pdu function in rdp/rdp_rdp.c in xrdp 0.4.1 and earlier allows remote RDP servers to h

23RISCO

abrir ↗

Referência★ 180

Unauthenticated Remote Code Execution – Bricks <= 1.9.6

CVE-2024-25600CRITICAL

WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability

85RISCO

abrir ↗

Referência✓ VexDay Proof

WebSVN 2.0 - Cross-Site Scripting / File Handling / Code Execution

CVE-2008-5918—webappsphp

Cross-site scripting (XSS) vulnerability in the getParameterisedSelfUrl function in index.php in WebSVN 2.0 and earlier

23RISCO

abrir ↗

Referência

CVE-2019-13720

CVE-2019-13720HIGHsob ataque

Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap

83RISCO

abrir ↗

Referência✓ VexDay Proof

Umer Inc Songs Portal Script - 'id' SQL Injection

CVE-2008-5921—webappsphp

SQL injection vulnerability in albums.php in Umer Inc Songs Portal allows remote attackers to execute arbitrary SQL comm

23RISCO

abrir ↗

Referência

CVE-2025-2776

CVE-2025-2776CRITICALsob ataque

SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection

100RISCO

abrir ↗

Referência

CVE-2016-1744

CVE-2016-1744—

The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary co

23RISCO

abrir ↗

Referência✓ VexDay Proof

Amaya 11.1 - W3C Editor/Browser (defer) Stack Overflow (PoC)

CVE-2009-1209—doswindows

Stack-based buffer overflow in W3C Amaya Web Browser 11.1 allows remote attackers to execute arbitrary code via a script

28RISCO

abrir ↗

Referência✓ VexDay Proof

Philex 0.2.3 - Remote File Inclusion / File Disclosure

CVE-2007-1697—webappsphp

PHP remote file inclusion vulnerability in header.inc.php in Philex 0.2.3 and earlier allows remote attackers to execute

45RISCO

abrir ↗

Referência✓ VexDay Proof

Vivotek Motion Jpeg Control - 'MjpegDecoder.dll 2.0.0.13' Remote Overflow

CVE-2007-3167—remotewindows

Stack-based buffer overflow in the Vivotek Motion Jpeg ActiveX control (aka MjpegControl) in MjpegDecoder.dll 2.0.0.13 a

23RISCO

abrir ↗

Referência✓ VexDay Proof

vsp stats processor 0.45 - 'gamestat.php?gameID' SQL Injection

CVE-2009-1224—webappsphp

SQL injection vulnerability in vsp-core/pub/themes/bismarck/gamestat.php in vsp stats processor 0.45 allows remote attac

23RISCO

abrir ↗

Referência✓ VexDay Proof

Active Business Directory 2 - Blind SQL Injection

CVE-2008-5972—webappsphp

SQL injection vulnerability in default.asp in Active Business Directory 2 allows remote attackers to execute arbitrary S

23RISCO

abrir ↗

Referência

CVE-2014-4880

CVE-2014-4880—

Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009, and other models and versions, allows remote atta

60RISCO

abrir ↗

Referência✓ VexDay Proof

Active Web Mail 4 - Authentication Bypass

CVE-2008-5973—webappsasp

SQL injection vulnerability in login.aspx in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL comman

23RISCO

abrir ↗

Referência✓ VexDay Proof

Active Price Comparison 4 - Authentication Bypass

CVE-2008-5974—webappsasp

Multiple SQL injection vulnerabilities in login.aspx in Active Price Comparison 4.0 allow remote attackers to execute ar

23RISCO

abrir ↗

Referência

CVE-2025-34299

CVE-2025-34299CRITICAL

Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload

85RISCO

abrir ↗

Referência

CVE-2010-3973

CVE-2010-3973—

The WMITools ActiveX control in WBEMSingleView.ocx 1.50.1131.0 in Microsoft WMI Administrative Tools 1.1 and earlier in

60RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.