Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.912exploits catalogados

36.852CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.475Referência 23.362GitHub PoC 15.234VulnCheck XDB 8.946Nuclei 4.393Metasploit 3.502✓ só verificadosrecentes populares risco

5.629 exploits

Referência✓ VexDay Proof

Dokeos 1.6.5 - 'courseLog.php?scormcontopen' SQL Injection

CVE-2007-2889—webappsphp

SQL injection vulnerability in tracking/courseLog.php in Dokeos 1.6.5 and earlier allows remote attackers to execute arb

23RISCO

abrir ↗

Referência✓ VexDay Proof

DreamNews Manager - 'id' SQL Injection

CVE-2008-3189—webappsphp

SQL injection vulnerability in dreamnews-rss.php in DreamNews Manager allows remote attackers to execute arbitrary SQL c

23RISCO

abrir ↗

Referência✓ VexDay Proof

P2P Foxy - Out of Memory Denial of Service

CVE-2008-6742—doswindows

Foxy P2P software allows remote attackers to cause a denial of service (memory consumption) via a foxy URI with a downlo

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component Pony Gallery 1.5 - SQL Injection

CVE-2007-4046—webappsphp

SQL injection vulnerability in index.php in the Pony Gallery (com_ponygallery) 1.5 and earlier component for Joomla! all

23RISCO

abrir ↗

Referência✓ VexDay Proof

xGB 2.0 - 'xGB.php' Remote Security Bypass

CVE-2007-4637—webappsphp

xGB.php in xGB 2.0 does not require authentication for an admin edit action, which allows remote attackers to make unspe

23RISCO

abrir ↗

Referência✓ VexDay Proof

Papoo CMS 3.x - 'pfadhier' Local File Inclusion

CVE-2009-0735—webappsphp

Directory traversal vulnerability in lib/classes/message_class.php in Papoo CMS 3.6, when register_globals is enabled an

23RISCO

abrir ↗

Referência✓ VexDay Proof

MySpeach 2.1b - 'up.php' Remote File Inclusion

CVE-2007-0498—webappsphp

PHP remote file inclusion vulnerability in up.php in MySpeach 2.1 beta and possibly earlier allows remote attackers to e

23RISCO

abrir ↗

Referência✓ VexDay Proof

iziContents rc6 - Local/Remote File Inclusion

CVE-2007-5053—webappsphp

Multiple incomplete blacklist vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to execute arbitra

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHP Project Management 0.8.10 - Multiple Local/Remote File Inclusions

CVE-2007-5641—webappsphp

Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers t

35RISCO

abrir ↗

Referência✓ VexDay Proof

Scribe 0.2 - 'index.php' Local File Inclusion

CVE-2008-0822—webappsphp

Directory traversal vulnerability in index.php in Scribe 0.2 allows remote attackers to read arbitrary local files via a

23RISCO

abrir ↗

Referência✓ VexDay Proof

Alstrasoft AskMe Pro 2.1 - Multiple SQL Injections

CVE-2008-2857—webappsphp

AlstraSoft AskMe Pro 2.1 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent a

23RISCO

abrir ↗

Referência✓ VexDay Proof

AyeView 2.20 - '.GIF' Image Local Crash

CVE-2008-5884—doswindows

AyeView 2.20 allows user-assisted attackers to cause a denial of service (application crash) via a GIF file with a malfo

23RISCO

abrir ↗

Referência✓ VexDay Proof

MKPortal 1.1.1 reviews / Gallery modules - SQL Injection

CVE-2007-3814—webappsphp

Multiple SQL injection vulnerabilities in MKPortal 1.1.1 allow remote attackers to execute arbitrary SQL commands via (1

23RISCO

abrir ↗

Referência✓ VexDay Proof

Vanilla 1.1.3 - Blind SQL Injection

CVE-2007-5644—webappsphp

Lussumo Vanilla 1.1.3 and earlier does not require admin privileges for (1) ajax/sortcategories.php and (2) ajax/sortrol

23RISCO

abrir ↗

Referência✓ VexDay Proof

MyBlog: PHP and MySQL Blog/CMS software - SQL Injection / Cross-Site Scripting

CVE-2008-6193—webappsphp

Sam Crew MyBlog stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain se

23RISCO

abrir ↗

Referência✓ VexDay Proof

Bitweaver 2.6 - 'saveFeed()' Remote Code Execution

CVE-2009-1677—webappsphp

Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 an

23RISCO

abrir ↗

Referência✓ VexDay Proof

Online Grades & Attendance 3.2.6 - Multiple Local File Inclusions

CVE-2009-2037—webappsphp

Multiple directory traversal vulnerabilities in Online Grades & Attendance 3.2.5 and earlier, and possibly 3.2.6, when r

23RISCO

abrir ↗

Referência✓ VexDay Proof

LulieBlog 1.0.1 - Remote Authentication Bypass

CVE-2008-0329—webappsphp

LulieBlog 1.0.1 and 1.0.2 does not restrict access to (1) article_suppr.php, (2) comment_accepter.php, and (3) comment_r

23RISCO

abrir ↗

Referência✓ VexDay Proof

DesktopOnNet 3 Beta - Multiple Remote File Inclusions

CVE-2008-2649—webappsphp

Multiple PHP remote file inclusion vulnerabilities in DesktopOnNet 3 Beta allow remote attackers to execute arbitrary PH

23RISCO

abrir ↗

Referência✓ VexDay Proof

Avlc Forum - 'vlc_forum.php' SQL Injection

CVE-2008-3200—webappsphp

SQL injection vulnerability in vlc_forum.php in Avlc Forum as of 20080715 allows remote attackers to execute arbitrary S

23RISCO

abrir ↗

Referência✓ VexDay Proof

Claroline E-Learning 1.75 - 'ldap.inc.php' Remote File Inclusion

CVE-2006-2284—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.5 allow remote attackers to execute arbitrary PHP co

23RISCO

abrir ↗

Referência✓ VexDay Proof

Ultrastats 0.2.142 - 'players-detail.php' Blind SQL Injection

CVE-2008-3241—webappsphp

SQL injection vulnerability in players-detail.php in UltraStats 0.2.136, 0.2.140, and 0.2.142 allows remote attackers to

23RISCO

abrir ↗

Referência✓ VexDay Proof

ASP Portal - Multiple SQL Injections

CVE-2008-5605—webappsasp

Multiple SQL injection vulnerabilities in ASP Portal allow remote attackers to execute arbitrary SQL commands via the (1

23RISCO

abrir ↗

Referência✓ VexDay Proof

k-rate - SQL Injection / Cross-Site Scripting

CVE-2008-7097—webappsphp

Multiple SQL injection vulnerabilities in Qsoft K-Rate Premium allow remote attackers to execute arbitrary SQL commands

23RISCO

abrir ↗

Referência✓ VexDay Proof

2DayBiz Template Monster Clone - 'edituser.php' Change Pass

CVE-2009-1767—webappsphp

admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote

23RISCO

abrir ↗

Referência✓ VexDay Proof

Relative Real Estate Systems 3.0 - 'listing_id' SQL Injection

CVE-2008-2881—webappsphp

Relative Real Estate Systems 3.0 and earlier stores passwords in cleartext in a MySQL database, which allows context-dep

23RISCO

abrir ↗

Referência✓ VexDay Proof

3editor CMS 0.42 - 'index.php' Local File Inclusion

CVE-2006-6877—webappsphp

Directory traversal vulnerability in index.php in Matteo Lucarelli 3editor CMS 0.42 and earlier, when register_globals i

23RISCO

abrir ↗

Referência✓ VexDay Proof

YouTube blog 0.1 - Remote File Inclusion / SQL Injection / Cross-Site Scripting

CVE-2008-3308—webappsphp

PHP remote file inclusion vulnerability in cuenta/cuerpo.php in C. Desseno YouTube Blog (ytb) 0.1, when register_globals

23RISCO

abrir ↗

Referência✓ VexDay Proof

F3Site 2.1 - Remote Code Execution

CVE-2007-0764—webappsphp

Unrestricted file upload vulnerability in F3Site 2.1 and earlier allows remote authenticated administrators to upload an

23RISCO

abrir ↗

Referência✓ VexDay Proof

CMS Ortus 1.13 - SQL Injection

CVE-2008-6282—webappsphp

SQL injection vulnerability in engine/users/users_edit_pub.inc in CMS Ortus 1.13 and earlier allows remote authenticated

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.