Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.900exploits catalogados

36.847CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.475Referência 23.360GitHub PoC 15.228VulnCheck XDB 8.946Nuclei 4.390Metasploit 3.501✓ só verificadosrecentes populares risco

5.629 exploits

Referência✓ VexDay Proof

XOOPS 2.3.1 - Multiple Local File Inclusions

CVE-2008-6884—webappsphp

Multiple directory traversal vulnerabilities in XOOPS 2.3.1, when register_globals is enabled, allow remote attackers to

23RISCO

abrir ↗

Referência✓ VexDay Proof

EntertainmentScript 1.4.0 - 'play.php' SQL Injection

CVE-2008-2393—webappsphp

SQL injection vulnerability in play.php in EntertainmentScript 1.4.0 allows remote attackers to execute arbitrary SQL co

23RISCO

abrir ↗

Referência✓ VexDay Proof

Multi-Threaded TFTP 1.1 - GET Denial of Service

CVE-2006-4781—doswindows

Heap-based buffer overflow in FutureSoft TFTP Server Multithreaded (MT) 1.1 allows remote attackers to cause a denial of

23RISCO

abrir ↗

Referência✓ VexDay Proof

TotalCalendar 2.30 - 'inc' Remote File Inclusion

CVE-2006-7055—webappsphp

PHP remote file inclusion vulnerability in index.php in TotalCalendar 2.30 and earlier allows remote attackers to execut

23RISCO

abrir ↗

Referência✓ VexDay Proof

WordPress Plugin fGallery 2.4.1 - 'fimrss.php' SQL Injection

CVE-2008-0491—webappsphp

SQL injection vulnerability in fim_rss.php in the fGallery 2.4.1 plugin for WordPress allows remote attackers to execute

23RISCO

abrir ↗

Referência✓ VexDay Proof

OpenGoo 1.1 - Local File Inclusion

CVE-2009-0286—webappsphp

Directory traversal vulnerability in upgrade/index.php in OpenGoo 1.1, when register_globals is enabled and magic_quotes

23RISCO

abrir ↗

Referência✓ VexDay Proof

HP Digital Imaging 'hpqvwocx.dll 2.1.0.556' - 'SaveToFile()' File Write

CVE-2007-3649—remotewindows

Absolute path traversal vulnerability in a certain ActiveX control in hpqvwocx.dll 2.1.0.556 in Hewlett-Packard (HP) Dig

23RISCO

abrir ↗

Referência✓ VexDay Proof

Hex Workshop 5.1.4 - Color Mapping File Local Buffer Overflow (PoC)

CVE-2008-5756—doswindows

Buffer overflow in BreakPoint Software Hex Workshop 5.1.4 allows user-assisted attackers to cause a denial of service an

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component com_pccookbook - 'recipe_id' Blind SQL Injection

CVE-2009-0329—webappsphp

SQL injection vulnerability in the PcCookBook (com_pccookbook) component for Joomla! allows remote attackers to execute

23RISCO

abrir ↗

Referência✓ VexDay Proof

CoreHTTP 0.5.3alpha - HTTPd Remote Buffer Overflow

CVE-2007-4060—remotelinux

Multiple buffer overflows in the HttpSprockMake function in http.c in Frank Yaul corehttp 0.5.3alpha allow remote attack

23RISCO

abrir ↗

Referência✓ VexDay Proof

Quate CMS 0.3.4 - Multiple Vulnerabilities

CVE-2008-2496—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in Quate CMS 0.3.4 allow remote attackers to inject arbitrary web sc

23RISCO

abrir ↗

Referência✓ VexDay Proof

Simple Machines Forum (SMF) 1.1.6 - Local File Inclusion / Code Execution

CVE-2008-6659—webappsphp

Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 all

23RISCO

abrir ↗

Referência✓ VexDay Proof

ZeusCMS 0.3 - Blind SQL Injection

CVE-2007-6623—webappsphp

Absolute path traversal vulnerability in ZeusCMS 0.3 and earlier might allow remote attackers to list arbitrary director

23RISCO

abrir ↗

Referência✓ VexDay Proof

blogit! - SQL Injection / File Disclosure / Cross-Site Scripting

CVE-2009-0336—webappsphp

Katy Whitton BlogIt! stores sensitive information under the web root with insufficient access control, which allows remo

23RISCO

abrir ↗

Referência✓ VexDay Proof

Advanced Links Management (ALM) 1.52 - SQL Injection

CVE-2008-2529—webappsphp

SQL injection vulnerability in read.php in Advanced Links Management (ALM) 1.5.2 allows remote attackers to execute arbi

23RISCO

abrir ↗

Referência✓ VexDay Proof

CDex 1.70b2 (Windows XP SP3) - '.ogg' Local Buffer Overflow

CVE-2009-1039—localwindows

Buffer overflow in CDex 1.70b2 allows remote attackers to execute arbitrary code via a crafted Info header in an Ogg Vor

23RISCO

abrir ↗

Referência✓ VexDay Proof

PsNews 1.1 - 'show.php?newspath' Local File Inclusion

CVE-2007-3772—webappsphp

Directory traversal vulnerability in news/show.php in PsNews 1.1 allows remote attackers to include and execute arbitrar

23RISCO

abrir ↗

Referência✓ VexDay Proof

CityWriter 0.9.7 - 'head.php' Remote File Inclusion

CVE-2007-6324—webappsphp

PHP remote file inclusion vulnerability in head.php in CityWriter 0.9.7 allows remote attackers to execute arbitrary PHP

23RISCO

abrir ↗

Referência✓ VexDay Proof

PLog 1.0.6 - 'albumID' SQL Injection

CVE-2008-2629—webappsphp

SQL injection vulnerability in the LifeType (formerly pLog) module for Drupal allows remote attackers to execute arbitra

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component beamospetition 1.0.12 - SQL Injection / Cross-Site Scripting

CVE-2009-0377—webappsphp

SQL injection vulnerability in the beamospetition (com_beamospetition) 1.0.12 component for Joomla! allows remote attack

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component beamospetition 1.0.12 - SQL Injection / Cross-Site Scripting

CVE-2009-0378—webappsphp

Cross-site scripting (XSS) vulnerability in index.php in the beamospetition (com_beamospetition) 1.0.12 component for Jo

23RISCO

abrir ↗

Referência✓ VexDay Proof

ezusermanager 1.6 - Remote File Inclusion

CVE-2006-2424—webappsphp

PHP remote file inclusion vulnerability in ezUserManager 1.6 and earlier, when register_globals is enabled, allows remot

23RISCO

abrir ↗

Referência✓ VexDay Proof

mebiblio 0.4.7 - SQL Injection / Arbitrary File Upload / Cross-Site Scripting

CVE-2008-2648—webappsphp

Unrestricted file upload vulnerability in upload/uploader.html in meBiblio 0.4.7 allows remote attackers to execute arbi

23RISCO

abrir ↗

Referência✓ VexDay Proof

TightVNC - Authentication Failure Integer Overflow (PoC)

CVE-2009-0388—doswindows

Multiple integer signedness errors in (1) UltraVNC 1.0.2 and 1.0.5 and (2) TightVnc 1.3.9 allow remote VNC servers to ca

28RISCO

abrir ↗

Referência✓ VexDay Proof

Community CMS 0.4 - 'id' Blind SQL Injection

CVE-2009-0406—webappsphp

SQL injection vulnerability in index.php in Community CMS 0.4 and earlier allows remote attackers to execute arbitrary S

23RISCO

abrir ↗

Referência✓ VexDay Proof

BoastMachine 3.1 - 'mail.php' id SQL Injection

CVE-2008-0422—webappsphp

SQL injection vulnerability in mail.php in boastMachine (aka bMachine) 3.1 and earlier allows remote attackers to execut

23RISCO

abrir ↗

Referência✓ VexDay Proof

YourFreeScreamer 1.0 - 'serverPath' Remote File Inclusion

CVE-2007-3271—webappsphp

PHP remote file inclusion vulnerability in templates/2blue/bodyTemplate.php in YourFreeScreamer 1.0 allows remote attack

23RISCO

abrir ↗

Referência✓ VexDay Proof

DMXReady Classified Listings Manager 1.1 - SQL Injection

CVE-2009-0426—webappsasp

SQL injection vulnerability in CategoryManager/upload_image_category.asp in DMXReady Classified Listings Manager 1.1 and

23RISCO

abrir ↗

Referência✓ VexDay Proof

VRNews 1.1.1 - 'admin.php' Remote Security Bypass

CVE-2007-3611—webappsphp

admin.php in VRNews 1.1.1, and possibly other 1.x versions, does not require authentication, which allows remote attacke

23RISCO

abrir ↗

Referência✓ VexDay Proof

Linksys WRT54G Firmware 1.00.9 - Security Bypass (1)

CVE-2008-1247—remotehardware

The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts,

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.