Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
83.853exploits catalogados
39.383CVEs com exploração pública
24.695testados em laboratório
TodosReferência 25.447Exploit-DB 24.485GitHub PoC 16.269VulnCheck XDB 9.651Nuclei 4.478Metasploit 3.523✓ só verificadosrecentespopularesrisco
3.523 exploits
Metasploit300
GitLab Unauthenticated Arbitrary File Read
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISCO
abrir ↗Metasploit500
N-able N-central Struts BeanUtils Unauthenticated RCE
pre-authentication remote code execution
98RISCO
abrir ↗Metasploit600
Langflow AI Validate Code Injection unauth RCE
Langflow code Code Injection Remote Code Execution Vulnerability
68RISCO
abrir ↗Metasploit500
SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi
66RISCO
abrir ↗Metasploit500
SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern
93RISCO
abrir ↗Metasploit600
Langflow AI Custom Component Authenticated RCE
Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement
56RISCO
abrir ↗Metasploit600
Langflow AI authenticated RCE
Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement
63RISCO
abrir ↗Metasploit600
PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)
PaperCut MF/NG: Authentication Bypass
100RISCO
abrir ↗Metasploit600
PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)
PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector
100RISCO
abrir ↗Metasploit600
Next.js Unauthenticated RCE on Windows Servers
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
63RISCO
abrir ↗Metasploit600
SPIP X-Spip-Filtre Unauthenticated RCE
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August
43RISCO
abrir ↗Metasploit600
Tenable Security Center SCAP Audit File Command Injection
Command Injection
63RISCO
abrir ↗Metasploit300
Forgejo Arbitrary File Read via Org-mode Include
Gitea Org-mode file disclosure and code execution
68RISCO
abrir ↗Metasploit300
Ruby on Rails Active Storage Vips Arbitrary File Read and Remote Code Execution
# Active Storage allowed transformation methods potentially unsafe
Active Storage attempts to prevent the use of pote
63RISCO
abrir ↗Metasploit300
Ruby on Rails Active Storage Vips Arbitrary File Read and Remote Code Execution
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
68RISCO
abrir ↗Metasploit600
JetBrains TeamCity Agent Polling Unauthenticated Remote Code Execution
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin
100RISCO
abrir ↗Metasploit600
Check Point SmartConsole Authentication Bypass Run Script RCE
Authentication Bypass in the SmartConsole Login Process Using an Application Token
100RISCO
abrir ↗Metasploit300
WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISCO
abrir ↗Metasploit300
WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗Metasploit600
WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISCO
abrir ↗Metasploit600
Langflow AI auto_login RCE
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
98RISCO
abrir ↗Metasploit600
WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗Metasploit600
SonicWall SMA1000 WorkPlace wsproxy SSRF Remote Command Execution
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A
93RISCO
abrir ↗Metasploit300
Wordpress Planyo Online Reservation System Arbitrary File Read (CVE-2026-3576)
Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter
56RISCO
abrir ↗Metasploit600
Langflow AI Code Validation Authenticated RCE
Code Injection Vulnerability in Code Validation Endpoint
63RISCO
abrir ↗Metasploit600
Flowise MCP Server Remote Code Execution
Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess
36RISCO
abrir ↗Metasploit600
SimpleHelp OIDC Authentication Bypass Remote Code Execution
SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification
93RISCO
abrir ↗Metasploit300
4gaBoards Mass User Information Disclosure (CVE-2026-53959)
4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated user
48RISCO
abrir ↗Metasploit600
Joomla Content Editor Unauthenticated File Upload RCE
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
98RISCO
abrir ↗página 1 / 118próximo →
Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.