Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

78.137exploits catalogados

35.961CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.458Referência 22.657GitHub PoC 14.424VulnCheck XDB 8.773Nuclei 4.340Metasploit 3.485✓ só verificadosrecentes populares risco

22.657 exploits

Referência

CVE-2026-6125

CVE-2026-6125MEDIUM

Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injection

33RISCO

abrir ↗

Referência

CVE-2026-18789

CVE-2026-18789HIGH

Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes

41RISCO

abrir ↗

Referência

CVE-2026-18474

CVE-2026-18474HIGH

WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category

41RISCO

abrir ↗

Referência

CVE-2026-16296

CVE-2026-16296MEDIUM

Clearfy < 2.4.3 - Open Redirect via Cyrlitera 404 Handler

33RISCO

abrir ↗

Referência

CVE-2026-16295

CVE-2026-16295MEDIUM

Clearfy < 2.4.3 - Subscriber+ Sensitive Information Disclosure via Factory Page-Action Dispatcher

33RISCO

abrir ↗

Referência

CVE-2018-13832

CVE-2018-13832—

Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plu

23RISCO

abrir ↗

Referência

CVE-2026-12198

CVE-2026-12198MEDIUM

Microweber API Endpoint thumbnail_img userfiles_path path traversal

33RISCO

abrir ↗

Referência

CVE-2016-6851

CVE-2016-6851—

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX G

23RISCO

abrir ↗

Referência

CVE-2016-6853

CVE-2016-6853—

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code and references to external websites can

23RISCO

abrir ↗

Referência

CVE-2026-8031

CVE-2026-8031MEDIUM

PicoTronica e-Clinic Healthcare System ECHS API Endpoint patient-records missing authentication

33RISCO

abrir ↗

Referência

CVE-2026-8028

CVE-2026-8028MEDIUM

FlowiseAI Flowise Endpoint account.service.ts verify information disclosure

33RISCO

abrir ↗

Referência

CVE-2026-7854

CVE-2026-7854CRITICAL

D-Link DI-8100 POST Parameter url_rule.asp url_rule_asp buffer overflow

48RISCO

abrir ↗

Referência

CVE-2026-7853

CVE-2026-7853CRITICAL

D-Link DI-8100 HTTP auto_reboot.asp sprintf buffer overflow

48RISCO

abrir ↗

Referência

CVE-2026-7851

CVE-2026-7851HIGH

D-Link DI-8100 yyxz.asp sprintf stack-based overflow

41RISCO

abrir ↗

Referência

CVE-2016-6909

CVE-2016-6909—

Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9

35RISCO

abrir ↗

Referência

CVE-2012-0982

CVE-2012-0982—

SQL injection vulnerability in search.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attacke

23RISCO

abrir ↗

Referência

CVE-2026-15474

CVE-2026-15474MEDIUM

Eleveo Call Recording Software audio.jsp improper authorization

33RISCO

abrir ↗

Referência✓ VexDay Proof

Interact 2.2 - 'CONFIG[base_path]' Remote File Inclusion

CVE-2006-4448—webappsphp

Multiple PHP remote file inclusion vulnerabilities in interact 2.2, when register_globals is enabled, allow remote attac

23RISCO

abrir ↗

Referência

CVE-2026-15958

CVE-2026-15958CRITICAL

Easy Dropbox Integration < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX

48RISCO

abrir ↗

Referência

CVE-2026-16536

CVE-2026-16536MEDIUM

Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id

33RISCO

abrir ↗

Referência

CVE-2026-16623

CVE-2026-16623HIGH

Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)

41RISCO

abrir ↗

Referência

CVE-2026-16618

CVE-2026-16618CRITICAL

ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution

48RISCO

abrir ↗

Referência

CVE-2026-18720

CVE-2026-18720MEDIUM

kalcaddle kodbox msgWarning Plugin action improper authorization

33RISCO

abrir ↗

Referência

CVE-2026-18686

CVE-2026-18686CRITICAL

GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection

48RISCO

abrir ↗

Referência

CVE-2026-15260

CVE-2026-15260MEDIUM

Geo My WP < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR

33RISCO

abrir ↗

Referência

CVE-2026-15231

CVE-2026-15231LOW

TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR

28RISCO

abrir ↗

Referência

CVE-2026-12175

CVE-2026-12175MEDIUM

CodeAstro Student Attendance Management System createStudents.php sql injection

33RISCO

abrir ↗

Referência

CVE-2026-48558

CVE-2026-48558CRITICAL

SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

53RISCO

abrir ↗

Referência

CVE-2016-7089

CVE-2016-7089—

WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco

23RISCO

abrir ↗

Referência

CVE-2026-11502

CVE-2026-11502LOW

JeecgBoot Third-Party Login ThirdLoginController.java HttpServletResponse.sendRedirect redirect

28RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.