Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

78.137exploits catalogados

35.961CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.458Referência 22.657GitHub PoC 14.424VulnCheck XDB 8.773Nuclei 4.340Metasploit 3.485✓ só verificadosrecentes populares risco

22.657 exploits

Referência

CVE-2026-4512

CVE-2026-4512LOW

WP reCaptcha by WebDesignBy < 2.0 – Admin+ Stored XSS

28RISCO

abrir ↗

Referência

CVE-2026-4106

CVE-2026-4106MEDIUM

HT Mega < 3.0.7 – Unauthenticated PII Disclosure

48RISCO

abrir ↗

Referência

CVE-2026-6878

CVE-2026-6878MEDIUM

ByteDance verl grader.py math_equal sandbox

33RISCO

abrir ↗

Referência

CVE-2026-6874

CVE-2026-6874MEDIUM

ericc-ch copilot-api Header token dns rebinding

33RISCO

abrir ↗

Referência

CVE-2026-40517

CVE-2026-40517HIGH

radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names

41RISCO

abrir ↗

Referência

CVE-2026-34413

CVE-2026-34413HIGH

Xerte Online Toolkits Missing Authentication via connector.php

56RISCO

abrir ↗

Referência

CVE-2026-34415

CVE-2026-34415CRITICAL

Xerte Online Toolkits File Upload RCE via elfinder Connector

63RISCO

abrir ↗

Referência✓ VexDay Proof

Absolute Control Panel XE 1.5 - Insecure Cookie Handling

CVE-2008-6859—webappsphp

Xigla Software Absolute Control Panel XE 1.5 allows remote attackers to bypass authentication and gain administrative ac

23RISCO

abrir ↗

Referência✓ VexDay Proof

Absolute Live Support 5.1 - Insecure Cookie Handling

CVE-2008-6864—webappsphp

Xigla Software Absolute Live Support .NET 5.1 allows remote attackers to bypass authentication and gain administrative a

23RISCO

abrir ↗

Referência✓ VexDay Proof

merlix educate servert - Authentication Bypass / File Disclosure

CVE-2008-6870—webappsasp

Merlix Educate Server allows remote attackers to bypass intended security restrictions and obtain sensitive information

23RISCO

abrir ↗

Referência✓ VexDay Proof

merlix educate servert - Authentication Bypass / File Disclosure

CVE-2008-6871—webappsasp

Merlix Educate Server stores db.mdb under the web root with insufficient access control, which allows remote attackers t

23RISCO

abrir ↗

Referência

CVE-2014-0997

CVE-2014-0997—

WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used i

23RISCO

abrir ↗

Referência

CVE-2014-0997

CVE-2014-0997—

WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used i

23RISCO

abrir ↗

Referência

CVE-2014-0999

CVE-2014-0999—

Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive

23RISCO

abrir ↗

Referência✓ VexDay Proof

dotProject 2.0.4 - 'baseDir' Remote File Inclusion

CVE-2006-4234—webappsphp

PHP remote file inclusion vulnerability in classes/query.class.php in dotProject 2.0.4 and earlier allows remote attacke

23RISCO

abrir ↗

Referência✓ VexDay Proof

ExoPHPDesk 1.2 Final - Authentication Bypass

CVE-2008-6917—webappsphp

SQL injection vulnerability in admin.php in Exocrew ExoPHPDesk 1.2 Final allows remote attackers to execute arbitrary SQ

23RISCO

abrir ↗

Referência

CVE-2026-63098

CVE-2026-63098MEDIUM

TheHive 4.1.24 Unauthenticated Information Disclosure via /api/status Endpoint

33RISCO

abrir ↗

Referência✓ VexDay Proof

ThePortal 2.2 - Arbitrary File Upload

CVE-2008-6918—webappsphp

Unrestricted file upload vulnerability in admin/galeria.php in ThePortal2 2.2 allows remote attackers to execute arbitra

23RISCO

abrir ↗

Referência

CVE-2026-63094

CVE-2026-63094HIGH

SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft

41RISCO

abrir ↗

Referência✓ VexDay Proof

TaskDriver 1.3 - Remote Change Admin Password

CVE-2008-6919—webappsphp

profileedit.php TaskDriver 1.3 and earlier allows remote attackers to bypass authentication and gain administrative acce

23RISCO

abrir ↗

Referência

CVE-2026-16017

CVE-2026-16017MEDIUM

mosaxiv clawlet cron Chat Tool tool_cron.go remove authorization

33RISCO

abrir ↗

Referência✓ VexDay Proof

PHPAdBoard - PHP uploads Arbitrary File Upload

CVE-2008-6921—webappsphp

Unrestricted file upload vulnerability in index.php in phpAdBoard 1.8 allows remote attackers to execute arbitrary code

23RISCO

abrir ↗

Referência

CVE-2017-8926

CVE-2017-8926—

Buffer overflow in Halliburton LogView Pro 10.0.1 allows attackers to cause a denial of service or possibly have unspeci

23RISCO

abrir ↗

Referência

CVE-2026-6621

CVE-2026-6621MEDIUM

1024bit extend-deep index.js prototype pollution

33RISCO

abrir ↗

Referência

CVE-2014-10014

CVE-2014-10014—

Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Event Booking Calendar 2.0 allow remote attacke

23RISCO

abrir ↗

Referência

CVE-2014-10020

CVE-2014-10020—

SQL injection vulnerability in login.php in Simple e-document 1.31 allows remote attackers to execute arbitrary SQL comm

23RISCO

abrir ↗

Referência

CVE-2026-16015

CVE-2026-16015MEDIUM

poco-ai poco-claw executor_manager API tasks.py create_task missing authentication

33RISCO

abrir ↗

Referência

CVE-2026-16015

CVE-2026-16015MEDIUM

poco-ai poco-claw executor_manager API tasks.py create_task missing authentication

33RISCO

abrir ↗

Referência

CVE-2026-16015

CVE-2026-16015MEDIUM

poco-ai poco-claw executor_manager API tasks.py create_task missing authentication

33RISCO

abrir ↗

Referência

CVE-2026-16015

CVE-2026-16015MEDIUM

poco-ai poco-claw executor_manager API tasks.py create_task missing authentication

33RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.