Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.866exploits catalogados

35.812CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.458Referência 22.573GitHub PoC 14.316VulnCheck XDB 8.722Nuclei 4.320Metasploit 3.477✓ só verificadosrecentes populares risco

22.573 exploits

Referência✓ VexDay Proof

Dokeos 1.6.5 - 'courseLog.php?scormcontopen' SQL Injection

CVE-2007-2889—webappsphp

SQL injection vulnerability in tracking/courseLog.php in Dokeos 1.6.5 and earlier allows remote attackers to execute arb

23RISCO

abrir ↗

Referência

CVE-2012-4281

CVE-2012-4281—

Multiple SQL injection vulnerabilities in Travelon Express 6.2.2 allow remote attackers to execute arbitrary SQL command

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHPizabi 0.848b C1 HFP3 - Database Information Disclosure

CVE-2008-2018—webappsphp

The AssignUser function in template.class.php in PHPizabi 0.848b C1 HFP3 performs unsafe macro expansions on strings del

23RISCO

abrir ↗

Referência✓ VexDay Proof

DreamNews Manager - 'id' SQL Injection

CVE-2008-3189—webappsphp

SQL injection vulnerability in dreamnews-rss.php in DreamNews Manager allows remote attackers to execute arbitrary SQL c

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component Pony Gallery 1.5 - SQL Injection

CVE-2007-4046—webappsphp

SQL injection vulnerability in index.php in the Pony Gallery (com_ponygallery) 1.5 and earlier component for Joomla! all

23RISCO

abrir ↗

Referência✓ VexDay Proof

P2P Foxy - Out of Memory Denial of Service

CVE-2008-6742—doswindows

Foxy P2P software allows remote attackers to cause a denial of service (memory consumption) via a foxy URI with a downlo

23RISCO

abrir ↗

Referência

CVE-2015-5452

CVE-2015-5452—

SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr

23RISCO

abrir ↗

Referência✓ VexDay Proof

xGB 2.0 - 'xGB.php' Remote Security Bypass

CVE-2007-4637—webappsphp

xGB.php in xGB 2.0 does not require authentication for an admin edit action, which allows remote attackers to make unspe

23RISCO

abrir ↗

Referência

CVE-2010-4400

CVE-2010-4400—

SQL injection vulnerability in _rights.php in DynPG CMS 4.2.0 allows remote attackers to execute arbitrary SQL commands

23RISCO

abrir ↗

Referência

CVE-2010-4400

CVE-2010-4400—

SQL injection vulnerability in _rights.php in DynPG CMS 4.2.0 allows remote attackers to execute arbitrary SQL commands

23RISCO

abrir ↗

Referência

CVE-2013-5716

CVE-2013-5716—

Gretech GOM Media Player 2.2.53.5169 and possibly earlier allows remote attackers to cause a denial of service (applicat

23RISCO

abrir ↗

Referência

CVE-2010-0754

CVE-2010-0754—

Cross-site scripting (XSS) vulnerability in index.php/Special/Main/Templates in WikyBlog 1.7.2 and 1.7.3 rc2 allows remo

23RISCO

abrir ↗

Referência

CVE-2010-0754

CVE-2010-0754—

Cross-site scripting (XSS) vulnerability in index.php/Special/Main/Templates in WikyBlog 1.7.2 and 1.7.3 rc2 allows remo

23RISCO

abrir ↗

Referência

CVE-2010-4874

CVE-2010-4874—

Multiple cross-site scripting (XSS) vulnerabilities in users.php in NinkoBB 1.3 RC5 allow remote attackers to inject arb

23RISCO

abrir ↗

Referência

CVE-2010-4874

CVE-2010-4874—

Multiple cross-site scripting (XSS) vulnerabilities in users.php in NinkoBB 1.3 RC5 allow remote attackers to inject arb

23RISCO

abrir ↗

Referência

CVE-2010-3137

CVE-2010-3137—

Untrusted search path vulnerability in Nullsoft Winamp 5.581, and probably other versions, allows local users, and possi

23RISCO

abrir ↗

Referência

CVE-2015-5453

CVE-2015-5453—

Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell

50RISCO

abrir ↗

Referência

CVE-2025-12735

CVE-2025-12735CRITICAL

CVE-2025-12735

48RISCO

abrir ↗

Referência

CVE-2009-4657

CVE-2009-4657—

The administrator package for Xerver 4.32 does not require authentication, which allows remote attackers to alter applic

23RISCO

abrir ↗

Referência

CVE-2013-10038

CVE-2013-10038CRITICAL

FlashChat Arbitrary File Upload RCE

63RISCO

abrir ↗

Referência✓ VexDay Proof

Papoo CMS 3.x - 'pfadhier' Local File Inclusion

CVE-2009-0735—webappsphp

Directory traversal vulnerability in lib/classes/message_class.php in Papoo CMS 3.6, when register_globals is enabled an

23RISCO

abrir ↗

Referência

CVE-2017-15958

CVE-2017-15958—

D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.

23RISCO

abrir ↗

Referência

CVE-2017-15958

CVE-2017-15958—

D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.

23RISCO

abrir ↗

Referência✓ VexDay Proof

XM Easy Personal FTP Server 1.0 - 'Port' Remote Overflow (PoC)

CVE-2006-2226—doswindows

Buffer overflow in XM Easy Personal FTP Server 4.2 and 5.0.1 allows remote authenticated users to cause a denial of serv

23RISCO

abrir ↗

Referência✓ VexDay Proof

MySpeach 2.1b - 'up.php' Remote File Inclusion

CVE-2007-0498—webappsphp

PHP remote file inclusion vulnerability in up.php in MySpeach 2.1 beta and possibly earlier allows remote attackers to e

23RISCO

abrir ↗

Referência✓ VexDay Proof

iziContents rc6 - Local/Remote File Inclusion

CVE-2007-5053—webappsphp

Multiple incomplete blacklist vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to execute arbitra

23RISCO

abrir ↗

Referência

CVE-2016-0400

CVE-2016-0400—

CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0

23RISCO

abrir ↗

Referência

CVE-2009-4993

CVE-2009-4993—

PHP remote file inclusion vulnerability in home.php in LM Starmail Paidmail 2.0 allows remote attackers to execute arbit

23RISCO

abrir ↗

Referência✓ VexDay Proof

zFeeder 1.6 - 'admin.php' Admin Bypass

CVE-2009-0807—webappsphp

zFeeder 1.6 allows remote attackers to gain administrative access via a direct request to admin.php.

23RISCO

abrir ↗

Referência

CVE-2015-4118

CVE-2015-4118—

SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated user

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.