Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.980exploits catalogados

36.899CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.476Referência 23.400GitHub PoC 15.250VulnCheck XDB 8.959Nuclei 4.393Metasploit 3.502✓ só verificadosrecentes populares risco

5.629 exploits

Referência✓ VexDay Proof

Gravity Board X 2.0 Beta - SQL Injection / (Authenticated) Code Execution

CVE-2009-1278—webappsphp

Static code injection vulnerability in forms/ajax/configure.php in Gravity Board X (GBX) 2.0 BETA allows remote attacker

23RISCO

abrir ↗

Referência✓ VexDay Proof

phpBB Module XS-Mod 2.3.1 - Local File Inclusion

CVE-2008-1512—webappsphp

Directory traversal vulnerability in admin/admin_xs.php in eXtreme Styles module (XS-Mod) 2.3.1 and 2.4.0 for phpBB allo

23RISCO

abrir ↗

Referência✓ VexDay Proof

Gelato - 'index.php?post' SQL Injection

CVE-2007-4918—webappsphp

SQL injection vulnerability in classes/gelato.class.php in Gelato allows remote attackers to execute arbitrary SQL comma

23RISCO

abrir ↗

Referência✓ VexDay Proof

Uebimiau Web-Mail 2.7.10/2.7.2 - Remote File Disclosure

CVE-2008-0140—webappsphp

Directory traversal vulnerability in error.php in Uebimiau Webmail 2.7.10 and 2.7.2 allows remote authenticated users to

23RISCO

abrir ↗

Referência✓ VexDay Proof

Aprox CMS Engine 5.1.0.4 - Local File Inclusion

CVE-2008-2895—webappsphp

Directory traversal vulnerability in index.php in AproxEngine 5.1.0.4 allows remote attackers to include and execute arb

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHP weather 2.2.2 - Local File Inclusion / Cross-Site Scripting

CVE-2008-5771—webappsphp

Directory traversal vulnerability in test.php in PHP Weather 2.2.2 allows remote attackers to include and execute arbitr

23RISCO

abrir ↗

Referência✓ VexDay Proof

Telephone Directory 2008 - Arbitrary Delete Contact

CVE-2008-7180—webappsphp

del_query1.php in Telephone Directory 2008 allows remote attackers to delete arbitrary contacts via a direct request wit

23RISCO

abrir ↗

Referência✓ VexDay Proof

ClipShare 2.6 - Remote User Password Change

CVE-2008-7188—webappsphp

ClipShare 2.6 does not properly restrict access to certain functionality, which allows remote attackers to change the pr

23RISCO

abrir ↗

Referência✓ VexDay Proof

Harpia CMS 1.0.5 - Remote File Inclusion

CVE-2006-7024—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Harpia CMS 1.0.5 and earlier allow remote attackers to execute arb

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHP-Nuke platinum 7.6.b.5 - Remote File Inclusion

CVE-2007-5676—webappsphp

PHP remote file inclusion vulnerability in modules/Forums/favorites.php in PHP-Nuke Platinum 7.6.b.5 allows remote attac

23RISCO

abrir ↗

Referência✓ VexDay Proof

PEEL CMS 3.x - Admin Hash Extraction / Arbitrary File Upload

CVE-2008-1507—webappsphp

PEEL, possibly 3.x and earlier, has (1) a default info@peel.fr account with password admin, and (2) a default contact@pe

23RISCO

abrir ↗

Referência✓ VexDay Proof

KubeLance 1.6.4 - 'ipn.php' Local File Inclusion

CVE-2008-2091—webappsphp

Directory traversal vulnerability in ipn.php in KubeLabs Kubelance 1.6.4 allows remote attackers to include and execute

23RISCO

abrir ↗

Referência✓ VexDay Proof

phpinv 0.8.0 - Local File Inclusion / Cross-Site Scripting

CVE-2008-2695—webappsphp

Directory traversal vulnerability in entry.php in phpInv 0.8.0 allows remote attackers to include and execute arbitrary

23RISCO

abrir ↗

Referência✓ VexDay Proof

FireAnt 1.3 - 'index.php' Local File Inclusion

CVE-2008-2896—webappsphp

Directory traversal vulnerability in index.php in FireAnt 1.3 allows remote attackers to include and execute arbitrary l

23RISCO

abrir ↗

Referência✓ VexDay Proof

LanSuite 3.3.2 - 'design' Local File Inclusion

CVE-2008-4330—webappsphp

Directory traversal vulnerability in index.php in LanSuite 3.3.2 allows remote attackers to include and execute arbitrar

23RISCO

abrir ↗

Referência✓ VexDay Proof

Globsy 1.0 - Remote File Rewriting

CVE-2008-5966—webappsphp

globsy_edit.php in Globsy 1.0 and earlier allows remote attackers to create or overwrite arbitrary files via a filename

23RISCO

abrir ↗

Referência✓ VexDay Proof

Ol BookMarks Manager 0.7.5 - Local File Inclusion / Remote File Inclusion / SQL Injection

CVE-2008-6407—webappsphp

Directory traversal vulnerability in frame.php in ol'bookmarks manager 0.7.5 allows remote attackers to include and exec

23RISCO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component live chat - SQL Injection / Open Proxy

CVE-2008-6882—webappsphp

Live Chat (com_livechat) component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP

23RISCO

abrir ↗

Referência✓ VexDay Proof

Libra PHP File Manager 1.18 - Insecure Cookie Handling

CVE-2008-7027—webappsphp

Libra File Manager 1.18 and earlier allows remote attackers to bypass authentication and gain privileges by setting the

23RISCO

abrir ↗

Referência✓ VexDay Proof

PAD Site Scripts 3.6 - Arbitrary Database Backup

CVE-2009-1941—webappsphp

PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which al

23RISCO

abrir ↗

Referência✓ VexDay Proof

VT-Auth 1.0 - 'zHk8dEes3.txt' File Disclosure

CVE-2009-2024—webappsasp

Vlad Titarenko ASP VT Auth 1.0 stores sensitive information under the web root with insufficient access control, which a

23RISCO

abrir ↗

Referência✓ VexDay Proof

PHPSpamManager 0.53b - 'body.php' Remote File Disclosure

CVE-2008-1645—webappsphp

Directory traversal vulnerability in body.php in phpSpamManager (phpSM) 0.53 beta allows remote attackers to read arbitr

23RISCO

abrir ↗

Referência✓ VexDay Proof

Microsoft Windows Media Encoder (XP SP2) - 'wmex.dll' ActiveX Buffer Overflow (MS08-053)

CVE-2008-3008—remotewindows

Stack-based buffer overflow in the WMEncProfileManager ActiveX control in wmex.dll in Microsoft Windows Media Encoder 9

50RISCO

abrir ↗

Referência✓ VexDay Proof

Aperto Blog 0.1.1 - Local File Inclusion / SQL Injection

CVE-2008-5776—webappsphp

Multiple directory traversal vulnerabilities in Aperto Blog 0.1.1 allow remote attackers to include and execute arbitrar

23RISCO

abrir ↗

Referência✓ VexDay Proof

ravennuke 2.3.0 - Multiple Vulnerabilities

CVE-2009-0674—webappsphp

images/captcha.php in Raven Web Services RavenNuke 2.30, when register_globals and display_errors are enabled, allows re

23RISCO

abrir ↗

Referência✓ VexDay Proof

ASP Product Catalog 1.0 - Cross-Site Scripting / File Disclosure

CVE-2009-1322—webappsphp

ASP Product Catalog 1.0 stores sensitive information under the web root with insufficient access control, which allows r

23RISCO

abrir ↗

Referência✓ VexDay Proof

Freelance Auction Script 1.0 - 'browseproject.php' SQL Injection

CVE-2008-2279—webappsphp

Freelance Auction Script 1.0 stores user passwords in plaintext in the tbl_users table, which allows attackers to gain p

23RISCO

abrir ↗

Referência✓ VexDay Proof

MonGoose 2.4 (Windows) - WebServer Directory Traversal

CVE-2009-1354—remotewindows

Directory traversal vulnerability in Mongoose 2.4 allows remote attackers to read arbitrary files via a .. (dot dot) in

23RISCO

abrir ↗

Referência✓ VexDay Proof

XZero Community Classifieds 4.95.11 - Remote File Inclusion

CVE-2007-6568—webappsphp

PHP remote file inclusion vulnerability in config.inc.php in XZero Community Classifieds 4.95.11 and earlier allows remo

23RISCO

abrir ↗

Referência✓ VexDay Proof

ScriptMagix Jokes 2.0 - 'index.php?catid' SQL Injection

CVE-2007-1615—webappsphp

SQL injection vulnerability in index.php in ScriptMagix Jokes 2.0 and earlier allows remote attackers to execute arbitra

23RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.