Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.866exploits catalogados

35.812CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.458Referência 22.573GitHub PoC 14.316VulnCheck XDB 8.722Nuclei 4.320Metasploit 3.477✓ só verificadosrecentes populares risco

22.573 exploits

Referência

CVE-2012-2396

CVE-2012-2396—

VideoLAN VLC media player 2.0.1 allows remote attackers to cause a denial of service (divide-by-zero error and applicati

23RISCO

abrir ↗

Referência

CVE-2026-14839

CVE-2026-14839HIGH

Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure

41RISCO

abrir ↗

Referência

CVE-2026-14823

CVE-2026-14823LOW

Event Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOR

28RISCO

abrir ↗

Referência

CVE-2026-14822

CVE-2026-14822MEDIUM

Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation

33RISCO

abrir ↗

Referência

CVE-2026-14561

CVE-2026-14561MEDIUM

Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure

33RISCO

abrir ↗

Referência

CVE-2026-14315

CVE-2026-14315MEDIUM

Pixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event Submission

33RISCO

abrir ↗

Referência

CVE-2026-14292

CVE-2026-14292MEDIUM

WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title

33RISCO

abrir ↗

Referência

CVE-2026-14214

CVE-2026-14214LOW

Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment

28RISCO

abrir ↗

Referência

CVE-2026-14195

CVE-2026-14195LOW

Brizy – Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_info

28RISCO

abrir ↗

Referência

CVE-2026-13729

CVE-2026-13729MEDIUM

Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF

33RISCO

abrir ↗

Referência

CVE-2026-13725

CVE-2026-13725HIGH

Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjax

41RISCO

abrir ↗

Referência

CVE-2026-13604

CVE-2026-13604MEDIUM

Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX

33RISCO

abrir ↗

Referência

CVE-2026-13596

CVE-2026-13596CRITICAL

Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search

48RISCO

abrir ↗

Referência

CVE-2026-13329

CVE-2026-13329MEDIUM

WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund

33RISCO

abrir ↗

Referência

CVE-2026-13157

CVE-2026-13157HIGH

Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload

41RISCO

abrir ↗

Referência

CVE-2026-11855

CVE-2026-11855HIGH

Simple Membership < 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API Version

41RISCO

abrir ↗

Referência

CVE-2026-10830

CVE-2026-10830HIGH

AllCoach < 1.0.2 - Unauthenticated Account Takeover

41RISCO

abrir ↗

Referência

CVE-2023-32560

CVE-2023-32560HIGH

An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disrup

78RISCO

abrir ↗

Referência

CVE-2023-32560

CVE-2023-32560HIGH

An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disrup

78RISCO

abrir ↗

Referência

CVE-2024-6228

CVE-2024-6228HIGH

WANotifier < 2.6 - Subscriber+ LFI

41RISCO

abrir ↗

Referência

CVE-2026-14789

CVE-2026-14789MEDIUM

radareorg radare2 Memory64ListStream mdmp.c stack-based overflow

33RISCO

abrir ↗

Referência

CVE-2020-7209

CVE-2020-7209—

LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.

60RISCO

abrir ↗

Referência

CVE-2026-14788

CVE-2026-14788MEDIUM

radareorg radare2 cfile.c r_core_bin_load use after free

33RISCO

abrir ↗

Referência

CVE-2026-14786

CVE-2026-14786MEDIUM

radareorg radare2 str.c r_str_word_get0set integer overflow

33RISCO

abrir ↗

Referência

CVE-2012-4031

CVE-2012-4031—

Multiple directory traversal vulnerabilities in src/acloglogin.php in Wangkongbao CNS-1000 and 1100 allow remote attacke

50RISCO

abrir ↗

Referência

CVE-2014-8654

CVE-2014-8654—

Multiple cross-site request forgery (CSRF) vulnerabilities in Compal Broadband Networks (CBN) CH6640E and CG6640E Wirele

23RISCO

abrir ↗

Referência

CVE-2010-4269

CVE-2010-4269—

SQL injection vulnerability in managechat.php in Collabtive 0.65 allows remote attackers to execute arbitrary SQL comman

23RISCO

abrir ↗

Referência

CVE-2010-4269

CVE-2010-4269—

SQL injection vulnerability in managechat.php in Collabtive 0.65 allows remote attackers to execute arbitrary SQL comman

23RISCO

abrir ↗

Referência

CVE-2010-4272

CVE-2010-4272—

SQL injection vulnerability in the Pulse Infotech Sponsor Wall (com_sponsorwall) component 1.1 for Joomla! allows remote

23RISCO

abrir ↗

Referência

CVE-2010-4633

CVE-2010-4633—

SQL injection vulnerability in cart.php in digiSHOP 2.0.2 allows remote attackers to execute arbitrary SQL commands via

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.