Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.900exploits catalogados

35.840CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.458Referência 22.600GitHub PoC 14.323VulnCheck XDB 8.722Nuclei 4.320Metasploit 3.477✓ só verificadosrecentes populares risco

22.600 exploits

Referência

CVE-2024-1783

CVE-2024-1783CRITICAL

Totolink LR1200GB Web Interface cstecgi.cgi loginAuth stack-based overflow

48RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component gigCalendar 1.0 - SQL Injection

CVE-2009-0726—webappsphp

SQL injection vulnerability in the GigCalendar (com_gigcal) component 1.0 for Mambo and Joomla! allows remote attackers

23RISCO

abrir ↗

Referência✓ VexDay Proof

wpQuiz 2.7 - Multiple SQL Injections

CVE-2007-6172—webappsphp

Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the id

23RISCO

abrir ↗

Referência

CVE-2010-2040

CVE-2010-2040—

Cross-site scripting (XSS) vulnerability in search.php in V-EVA Shopzilla Affiliate Script PHP allows remote attackers t

23RISCO

abrir ↗

Referência✓ VexDay Proof

123tkShop 0.9.1 - Remote Authentication Bypass

CVE-2007-6458—webappsphp

SQL injection vulnerability in shop/mainfile.php in 123tkShop 0.9.1 allows remote attackers to execute arbitrary SQL com

23RISCO

abrir ↗

Referência

CVE-2013-4659

CVE-2013-4659—

Buffer overflow in Broadcom ACSD allows remote attackers to execute arbitrary code via a long string to TCP port 5916. T

28RISCO

abrir ↗

Referência

CVE-2015-5889

CVE-2015-5889—

rsh in the remote_cmds component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors inv

38RISCO

abrir ↗

Referência✓ VexDay Proof

NetHoteles 3.0 - 'ficha.php' SQL Injection

CVE-2009-1346—webappsphp

SQL injection vulnerability in publico/ficha.php in NetHoteles 3.0 allows remote attackers to execute arbitrary SQL comm

23RISCO

abrir ↗

Referência

CVE-2009-3333

CVE-2009-3333—

PHP remote file inclusion vulnerability in koesubmit.php in the koeSubmit (com_koesubmit) component 1.0 for Mambo allows

23RISCO

abrir ↗

Referência

CVE-2009-3055

CVE-2009-3055—

PHP remote file inclusion vulnerability in engine/api/api.class.php in DataLife Engine (DLE) 8.2 allows remote attackers

23RISCO

abrir ↗

Referência

CVE-2015-3141

CVE-2015-3141—

Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier

23RISCO

abrir ↗

Referência

CVE-2022-31056

CVE-2022-31056CRITICAL

SQL injection with _actor parameter in GLPI

48RISCO

abrir ↗

Referência✓ VexDay Proof

PHP Classifieds Script 05122008 - SQL Injection

CVE-2008-2453—webappsphp

Multiple SQL injection vulnerabilities in PHP Classifieds Script allow remote attackers to execute arbitrary SQL command

23RISCO

abrir ↗

Referência

CVE-2026-18052

CVE-2026-18052HIGH

ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters

41RISCO

abrir ↗

Referência

CVE-2009-3543

CVE-2009-3543—

SQL injection vulnerability in _phenotype/admin/login.php in Phenotype CMS before 2.9 allows remote attackers to execute

23RISCO

abrir ↗

Referência

CVE-2026-16738

CVE-2026-16738MEDIUM

Conekta Payment Gateway < 6.2.2 - Unauthenticated Order Payment Completion via Webhook Forgery

33RISCO

abrir ↗

Referência

CVE-2009-3718

CVE-2009-3718—

SQL injection vulnerability in admin/authenticate.asp in Battle Blog 1.25 and 1.30 build 2 allows remote attackers to ex

23RISCO

abrir ↗

Referência

CVE-2026-16612

CVE-2026-16612MEDIUM

FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure

33RISCO

abrir ↗

Referência

CVE-2019-13493

CVE-2019-13493—

In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged u

23RISCO

abrir ↗

Referência

CVE-2018-10365

CVE-2018-10365—

An XSS issue was discovered in the Threads to Link plugin 1.3 for MyBB. When editing a thread, the user is given the opt

23RISCO

abrir ↗

Referência

CVE-2018-5263

CVE-2018-5263—

The StackIdeas EasyDiscuss (aka com_easydiscuss) extension before 4.0.21 for Joomla! allows XSS.

23RISCO

abrir ↗

Referência

CVE-2010-3209

CVE-2010-3209—

Multiple PHP remote file inclusion vulnerabilities in Seagull 0.6.7 allow remote attackers to execute arbitrary PHP code

23RISCO

abrir ↗

Referência

CVE-2010-3209

CVE-2010-3209—

Multiple PHP remote file inclusion vulnerabilities in Seagull 0.6.7 allow remote attackers to execute arbitrary PHP code

23RISCO

abrir ↗

Referência

CVE-2016-6689

CVE-2016-6689—

Binder in the kernel in Android before 2016-10-05 on Nexus devices allows attackers to obtain sensitive information via

23RISCO

abrir ↗

Referência

CVE-2015-6100

CVE-2015-6100—

The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wi

23RISCO

abrir ↗

Referência

CVE-2016-8742

CVE-2016-8742—

The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in t

23RISCO

abrir ↗

Referência

CVE-2017-0091

CVE-2017-0091—

Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers

28RISCO

abrir ↗

Referência

CVE-2010-1874

CVE-2010-1874—

SQL injection vulnerability in the Real Estate Property (com_properties) component 3.1.22-03 for Joomla! allows remote a

23RISCO

abrir ↗

Referência

CVE-2026-16260

CVE-2026-16260MEDIUM

Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field

33RISCO

abrir ↗

Referência

Neo Billing 3.5 - Persistent Cross-Site Scripting

CVE-2020-23518—webappsphp

Cross Site Scripting (XSS) vulnerability in UltimateKode Neo Billing - Accounting, Invoicing And CRM Software up to vers

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.