Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.900exploits catalogados

36.847CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.475Referência 23.360GitHub PoC 15.228VulnCheck XDB 8.946Nuclei 4.390Metasploit 3.501✓ só verificadosrecentes populares risco

5.629 exploits

Referência✓ VexDay Proof

Liberum Help Desk 0.97.3 - SQL Injection / File Disclosure

CVE-2008-6057—webappsphp

Doug Luxem Liberum Help Desk 0.97.3 stores db/helpdesk2000.mdb under the web root with insufficient access control, whic

23RISCO

abrir ↗

Referência✓ VexDay Proof

ColdFusion Scripts Red_Reservations - Database Disclosure

CVE-2008-6580—webappsasp

The Red_Reservations script for ColdFusion stores sensitive information under the web root with insufficient access cont

23RISCO

abrir ↗

Referência✓ VexDay Proof

Ocean12 FAQ Manager Pro - Database Disclosure

CVE-2008-7063—webappsphp

Ocean12 FAQ Manager Pro stores sensitive data under the web root with insufficient access control, which allows remote a

23RISCO

abrir ↗

Referência✓ VexDay Proof

cf shopkart 5.2.2 - SQL Injection / File Disclosure

CVE-2008-6321—webappsasp

CF Shopkart 5.2.2 stores cfshopkart52.mdb under the web root with insufficient access control, which allows remote attac

23RISCO

abrir ↗

Referência✓ VexDay Proof

TopList 1.3.8 - 'phpBB Hack' Remote File Inclusion (1)

CVE-2006-2151—webappsphp

PHP remote file inclusion vulnerability in toplist.php in phpBB TopList 1.3.8 and earlier, when register_globals is enab

28RISCO

abrir ↗

Referência✓ VexDay Proof

PhShoutBox 1.5 - Insecure Cookie Handling

CVE-2008-1971—webappsphp

phShoutBox Final 1.5 and earlier only checks passwords when specified in $_POST, which allows remote attackers to gain p

23RISCO

abrir ↗

Referência✓ VexDay Proof

DreamPics Builder - 'page' SQL Injection

CVE-2008-3119—webappsphp

SQL injection vulnerability in index.php in DreamPics Builder allows remote attackers to execute arbitrary SQL commands

23RISCO

abrir ↗

Referência✓ VexDay Proof

Oracle 10g - 'LT.FINDRICSET' SQL Injection (IDS Evasion)

CVE-2007-5511—localmultiple

SQL injection vulnerability in Workspace Manager for Oracle Database before OWM 10.2.0.4.1, OWM 10.1.0.8.0, and OWM 9.2.

50RISCO

abrir ↗

Referência✓ VexDay Proof

HIOX Banner Rotator 1.3 - 'hm' Remote File Inclusion

CVE-2008-3127—webappsphp

PHP remote file inclusion vulnerability in hioxBannerRotate.php in HIOX Banner Rotator (HBR) 1.3, when register_globals

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component BibTeX 1.3 - Blind SQL Injection

CVE-2007-4502—webappsphp

SQL injection vulnerability in index.php in the BibTeX component (com_jombib) 1.3 and earlier for Joomla! allows remote

23RISCO

abrir ↗

Referência✓ VexDay Proof

CcMail 1.0.1 - Insecure Cookie Handling

CVE-2008-1904—webappsphp

Cicoandcico CcMail 1.0.1 and earlier does not verify that the this_cookie cookie corresponds to an authenticated session

23RISCO

abrir ↗

Referência✓ VexDay Proof

Download Accelerator Plus DAP 8.x - '.m3u' File Buffer Overflow

CVE-2008-3182—localwindows

Stack-based buffer overflow in DAP.exe in Download Accelerator Plus (DAP) 7.0.1.3, 8.6.6.3, and other 8.x versions allow

23RISCO

abrir ↗

Referência✓ VexDay Proof

TOWeLS 0.1 - 'scripture.php' Remote File Inclusion

CVE-2007-5628—webappsphp

PHP remote file inclusion vulnerability in src/scripture.php in The Online Web Library Site (TOWels) 0.1 allows remote a

28RISCO

abrir ↗

Referência✓ VexDay Proof

CCLeague Pro 1.2 - Insecure Cookie Authentication

CVE-2008-5125—webappsphp

admin.php in CCleague Pro 1.2 allows remote attackers to bypass authentication by setting the type cookie value to admin

23RISCO

abrir ↗

Referência✓ VexDay Proof

4Images 1.7.7 - Filter Bypass HTML Injection / Cross-Site Scripting

CVE-2009-2131—webappsphp

Cross-site scripting (XSS) vulnerability in 4images 1.7.7 and earlier allows remote authenticated users to inject arbitr

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHPizabi 0.848b C1 HFP3 - Database Information Disclosure

CVE-2008-2018—webappsphp

The AssignUser function in template.class.php in PHPizabi 0.848b C1 HFP3 performs unsafe macro expansions on strings del

23RISCO

abrir ↗

Referência✓ VexDay Proof

Dokeos 1.6.5 - 'courseLog.php?scormcontopen' SQL Injection

CVE-2007-2889—webappsphp

SQL injection vulnerability in tracking/courseLog.php in Dokeos 1.6.5 and earlier allows remote attackers to execute arb

23RISCO

abrir ↗

Referência✓ VexDay Proof

DreamNews Manager - 'id' SQL Injection

CVE-2008-3189—webappsphp

SQL injection vulnerability in dreamnews-rss.php in DreamNews Manager allows remote attackers to execute arbitrary SQL c

23RISCO

abrir ↗

Referência✓ VexDay Proof

P2P Foxy - Out of Memory Denial of Service

CVE-2008-6742—doswindows

Foxy P2P software allows remote attackers to cause a denial of service (memory consumption) via a foxy URI with a downlo

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component Pony Gallery 1.5 - SQL Injection

CVE-2007-4046—webappsphp

SQL injection vulnerability in index.php in the Pony Gallery (com_ponygallery) 1.5 and earlier component for Joomla! all

23RISCO

abrir ↗

Referência✓ VexDay Proof

xGB 2.0 - 'xGB.php' Remote Security Bypass

CVE-2007-4637—webappsphp

xGB.php in xGB 2.0 does not require authentication for an admin edit action, which allows remote attackers to make unspe

23RISCO

abrir ↗

Referência✓ VexDay Proof

Papoo CMS 3.x - 'pfadhier' Local File Inclusion

CVE-2009-0735—webappsphp

Directory traversal vulnerability in lib/classes/message_class.php in Papoo CMS 3.6, when register_globals is enabled an

23RISCO

abrir ↗

Referência✓ VexDay Proof

MySpeach 2.1b - 'up.php' Remote File Inclusion

CVE-2007-0498—webappsphp

PHP remote file inclusion vulnerability in up.php in MySpeach 2.1 beta and possibly earlier allows remote attackers to e

23RISCO

abrir ↗

Referência✓ VexDay Proof

iziContents rc6 - Local/Remote File Inclusion

CVE-2007-5053—webappsphp

Multiple incomplete blacklist vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to execute arbitra

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHP Project Management 0.8.10 - Multiple Local/Remote File Inclusions

CVE-2007-5641—webappsphp

Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers t

35RISCO

abrir ↗

Referência✓ VexDay Proof

phpBB Ajax Shoutbox 0.0.5 - Remote File Inclusion

CVE-2006-5312—webappsphp

PHP remote file inclusion vulnerability in shoutbox.php in the Ajax Shoutbox 0.0.5 and earlier module for phpBB allows r

23RISCO

abrir ↗

Referência✓ VexDay Proof

zFeeder 1.6 - 'admin.php' Admin Bypass

CVE-2009-0807—webappsphp

zFeeder 1.6 allows remote attackers to gain administrative access via a direct request to admin.php.

23RISCO

abrir ↗

Referência✓ VexDay Proof

MiniGal b13 - Remote Code Execution

CVE-2007-2145—webappsphp

The imagecomments function in classes.php in MiniGal b13 allows remote attackers to inject arbitrary PHP code into a fil

23RISCO

abrir ↗

Referência✓ VexDay Proof

VWar 1.5.0 R15 - 'mvcw.php' Remote File Inclusion

CVE-2007-4605—webappsphp

PHP remote file inclusion vulnerability in convert/mvcw.php in Virtual War (VWar) 1.5.0 R15 and earlier allows remote at

23RISCO

abrir ↗

Referência✓ VexDay Proof

Scribe 0.2 - 'index.php' Local File Inclusion

CVE-2008-0822—webappsphp

Directory traversal vulnerability in index.php in Scribe 0.2 allows remote attackers to read arbitrary local files via a

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.