Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.900exploits catalogados

35.840CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.458Referência 22.600GitHub PoC 14.323VulnCheck XDB 8.722Nuclei 4.320Metasploit 3.477✓ só verificadosrecentes populares risco

22.600 exploits

Referência

CVE-2018-11443

CVE-2018-11443—

The parameter q is affected by Cross-site Scripting in jobcard-ongoing.php in EasyService Billing 1.0.

23RISCO

abrir ↗

Referência

CVE-2026-33829

CVE-2026-33829MEDIUM

Windows Snipping Tool Spoofing Vulnerability

33RISCO

abrir ↗

Referência✓ VexDay Proof

JShop 1.x < 2.x - 'xPage' Local File Inclusion

CVE-2008-1624—webappsphp

Directory traversal vulnerability in v2demo/page.php in Jshop Server 1.x through 2.x allows remote attackers to include

23RISCO

abrir ↗

Referência

CVE-2017-6331

CVE-2017-6331—

Prior to SEP 14 RU1 Symantec Endpoint Protection product can encounter an issue of Tamper-Protection Bypass, which is a

23RISCO

abrir ↗

Referência

CVE-2009-4748

CVE-2009-4748—

SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows

23RISCO

abrir ↗

Referência

CVE-2009-4748

CVE-2009-4748—

SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows

23RISCO

abrir ↗

Referência✓ VexDay Proof

UBBCentral UBB.Threads 6.4.x < 6.5.2 - 'thispath' Remote File Inclusion

CVE-2006-2568—webappsphp

PHP remote file inclusion vulnerability in addpost_newpoll.php in UBB.threads 6.4 through 6.5.2 and 6.5.1.1 (trial) allo

23RISCO

abrir ↗

Referência✓ VexDay Proof

VidShare Pro - Arbitrary File Upload

CVE-2009-1750—webappsphp

Unrestricted file upload vulnerability in VidSharePro allows remote authenticated users to execute arbitrary code by upl

23RISCO

abrir ↗

Referência

CVE-2015-1517

CVE-2015-1517—

SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to

23RISCO

abrir ↗

Referência

CVE-2010-0967

CVE-2010-0967—

Multiple directory traversal vulnerabilities in Geekhelps ADMP 1.01, when magic_quotes_gpc is disabled, allow remote att

23RISCO

abrir ↗

Referência

CVE-2024-27620

CVE-2024-27620HIGH

An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote attacker to obtain sensitive information via a crafted request

41RISCO

abrir ↗

Referência

CVE-2010-1475

CVE-2010-1475—

Directory traversal vulnerability in the Preventive & Reservation (com_preventive) component 1.0.5 for Joomla! allows re

38RISCO

abrir ↗

Referência✓ VexDay Proof

Sisfo Kampus 2006 - 'dwoprn.php?f' Arbitrary File Download

CVE-2007-4895—webappsphp

Directory traversal vulnerability in dwoprn.php in Sisfo Kampus 2006 (Semarang 3) allows remote attackers to read arbitr

23RISCO

abrir ↗

Referência

CVE-2026-74843

CVE-2026-74843CRITICAL

Wavlink WN531P3/WN535M1 Export Pingortrace CGI export_pingortrace.cgi strcpy stack-based overflow

48RISCO

abrir ↗

Referência✓ VexDay Proof

AlkalinePHP 0.77.35 - 'adduser.php' Arbitrary Add Admin

CVE-2008-2346—webappsphp

AlkalinePHP 0.77.35 and earlier allows remote attackers to bypass authentication and gain administrative access by creat

23RISCO

abrir ↗

Referência

CVE-2014-2022

CVE-2014-2022—

SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier a

23RISCO

abrir ↗

Referência

CVE-2010-4313

CVE-2010-4313—

Unrestricted file upload vulnerability in fileman_file_upload.php in Orbis CMS 1.0.2 allows remote authenticated users t

23RISCO

abrir ↗

Referência

aiohttp 3.9.1 - directory traversal PoC

CVE-2024-23334MEDIUMwebappspython

aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

70RISCO

abrir ↗

Referência

CVE-2025-34054

CVE-2025-34054CRITICAL

AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command Injection

48RISCO

abrir ↗

Referência

CVE-2025-34054

CVE-2025-34054CRITICAL

AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command Injection

48RISCO

abrir ↗

Referência

CVE-2015-7252

CVE-2015-7252—

Cross-site scripting (XSS) vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_

23RISCO

abrir ↗

Referência

CVE-2012-6038

CVE-2012-6038—

admin/core/admin_func.php in razorCMS before 1.2.1 does not properly restrict access to certain administrator directorie

23RISCO

abrir ↗

Referência✓ VexDay Proof

Tlnews 2.2 - Insecure Cookie Handling

CVE-2008-4752—webappsphp

TlNews 2.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlNews_login c

23RISCO

abrir ↗

Referência✓ VexDay Proof

adaptweb 0.9.2 - Local File Inclusion / SQL Injection

CVE-2009-2151—webappsphp

Directory traversal vulnerability in index.php in AdaptWeb 0.9.2 allows remote attackers to read arbitrary files via a .

23RISCO

abrir ↗

Referência

CVE-2010-1477

CVE-2010-1477—

SQL injection vulnerability in the SermonSpeaker (com_sermonspeaker) component before 3.2.1 for Joomla! allows remote at

23RISCO

abrir ↗

Referência

CVE-2015-2680

CVE-2015-2680—

Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack th

23RISCO

abrir ↗

Referência✓ VexDay Proof

Poppawid 2.7 - 'form' Remote File Inclusion

CVE-2007-5221—webappsphp

PHP remote file inclusion vulnerability in mail/childwindow.inc.php in Poppawid 2.7 allows remote attackers to execute a

23RISCO

abrir ↗

Referência✓ VexDay Proof

RunCMS 1.6 - Multiple Vulnerabilities

CVE-2007-6546—webappsphp

RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a m

23RISCO

abrir ↗

Referência

CVE-2014-9099

CVE-2014-9099—

Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attacker

23RISCO

abrir ↗

Referência

CVE-2026-15751

CVE-2026-15751MEDIUM

mastergo-design mastergo-magic-mcp mcp__getComponentGenerator component-workflow.md execute path traversal

33RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.