Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

84.031exploits catalogados

39.530CVEs com exploração pública

24.695testados em laboratório

Todos Referência 25.557Exploit-DB 24.485GitHub PoC 16.309VulnCheck XDB 9.678Nuclei 4.478Metasploit 3.524✓ só verificadosrecentes populares risco

25.447 exploits

Referência✓ VexDay Proof

phpGreetCards - Cross-Site Scripting / Arbitrary File Upload

CVE-2008-6848—webappsphp

Cross-site scripting (XSS) vulnerability in index.php in phpGreetCards 3.7 allows remote attackers to inject arbitrary w

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component Ice Gallery 0.5b2 - 'catid' Blind SQL Injection

CVE-2008-6852—webappsphp

SQL injection vulnerability in the Ice Gallery (com_ice) component 0.5 beta 2 for Joomla! allows remote attackers to exe

23RISCO

abrir ↗

Referência

CVE-2026-56121

CVE-2026-56121CRITICAL

Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization

48RISCO

abrir ↗

Referência✓ VexDay Proof

Absolute News Feed 1.0 - Remote Insecure Cookie Handling

CVE-2008-6855—webappsphp

Xigla Software Absolute News Feed 1.0 and possibly 1.5 allows remote attackers to bypass authentication and gain adminis

23RISCO

abrir ↗

Referência

CVE-2026-7669

CVE-2026-7669MEDIUM

sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection

33RISCO

abrir ↗

Referência

CVE-2026-7669

CVE-2026-7669MEDIUM

sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection

33RISCO

abrir ↗

Referência

CVE-2026-7672

CVE-2026-7672MEDIUM

youlaitech youlai-boot Users Endpoint UserController.java getUserList sql injection

33RISCO

abrir ↗

Referência

CVE-2026-7384

CVE-2026-7384MEDIUM

ezequiroga mcp-bases research_server.py search_papers path traversal

33RISCO

abrir ↗

Referência

CVE-2026-7671

CVE-2026-7671MEDIUM

CodeWise Tornet Scooter Mobile App TwoFactor excessive authentication

33RISCO

abrir ↗

Referência

CVE-2026-7668

CVE-2026-7668MEDIUM

MikroTik RouterOS SCEP Endpoint scep.p ASN1_STRING_data out-of-bounds

33RISCO

abrir ↗

Referência

CVE-2026-7653

CVE-2026-7653MEDIUM

r-huijts mcp-server-rijksmuseum MCP index.ts open_image_in_browser os command injection

33RISCO

abrir ↗

Referência

CVE-2026-56111

CVE-2026-56111HIGH

Marlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code Handler

41RISCO

abrir ↗

Referência

CVE-2026-55200

CVE-2026-55200CRITICAL

libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c

48RISCO

abrir ↗

Referência

CVE-2010-5009

CVE-2010-5009—

SQL injection vulnerability in index.php in UTStats Beta 4 and earlier allows remote attackers to execute arbitrary SQL

23RISCO

abrir ↗

Referência✓ VexDay Proof

Beryo 2.0 - 'downloadpic.php?chemin' Remote File Disclosure

CVE-2007-1929—webappsphp

Directory traversal vulnerability in downloadpic.php in Beryo 2.0, and possibly other versions including 2.4, allows rem

23RISCO

abrir ↗

Referência✓ VexDay Proof

PcP-Guestbook 3.0 - 'lang' Local File Inclusion

CVE-2007-1933—webappsphp

Multiple directory traversal vulnerabilities in PcP-Guestbook (PcP-Book) 3.0 allow remote attackers to include and execu

23RISCO

abrir ↗

Referência

CVE-2026-9815

CVE-2026-9815MEDIUM

MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCE

33RISCO

abrir ↗

Referência✓ VexDay Proof

Prediction Football 1.x - 'matchid' SQL Injection

CVE-2008-1732—webappsphp

SQL injection vulnerability in showpredictionsformatch.php in Prediction Football 1.x allows remote attackers to execute

23RISCO

abrir ↗

Referência✓ VexDay Proof

Linux Kernel < 2.6.26.4 - SCTP Kernel Memory Disclosure

CVE-2008-4113—locallinux

The sctp_getsockopt_hmac_ident function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implemen

23RISCO

abrir ↗

Referência

CVE-2025-54236

CVE-2025-54236CRITICALsob ataque

Adobe Commerce | Improper Input Validation (CWE-20)

100RISCO

abrir ↗

Referência

CVE-2021-22502

CVE-2021-22502CRITICALsob ataque

Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The

100RISCO

abrir ↗

Referência

CVE-2025-20281

CVE-2025-20281CRITICALsob ataque

Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

100RISCO

abrir ↗

Referência✓ VexDay Proof

ForumApp 3.3 - Remote Database Disclosure

CVE-2008-6147—webappsasp

ForumApp 3.3 stores sensitive information under the web root with insufficient access control, which allows remote attac

23RISCO

abrir ↗

Referência✓ VexDay Proof

Absolute Control Panel XE 1.5 - Insecure Cookie Handling

CVE-2008-6859—webappsphp

Xigla Software Absolute Control Panel XE 1.5 allows remote attackers to bypass authentication and gain administrative ac

23RISCO

abrir ↗

Referência✓ VexDay Proof

merlix educate servert - Authentication Bypass / File Disclosure

CVE-2008-6870—webappsasp

Merlix Educate Server allows remote attackers to bypass intended security restrictions and obtain sensitive information

23RISCO

abrir ↗

Referência

CVE-2020-25223

CVE-2020-25223CRITICALsob ataque

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511

100RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component Content 1.0.0 - 'itemID' SQL Injection

CVE-2008-6923—webappsphp

SQL injection vulnerability in the content component (com_content) 1.0.0 for Joomla! allows remote attackers to execute

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHPStore Real Estate - Arbitrary File Upload

CVE-2008-6930—webappsphp

Unrestricted file upload vulnerability in PHPStore Real Estate allows remote authenticated users to execute arbitrary co

23RISCO

abrir ↗

Referência✓ VexDay Proof

pl-PHP Beta 0.9 - Multiple Vulnerabilities

CVE-2007-2006—webappsphp

Multiple SQL injection vulnerabilities in login.php in pL-PHP beta 0.9 allow remote attackers to execute arbitrary SQL c

23RISCO

abrir ↗

Referência

CVE-2008-4178

CVE-2008-4178—

SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and D

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.