Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.950 exploits
VulnCheck XDB
initial-access
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISCO
abrir ↗VulnCheck XDB
initial-access
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISCO
abrir ↗VulnCheck XDB
initial-access
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISCO
abrir ↗GitHub PoC
Vulhub libssh/CVE-2018-10933: libssh Server Authentication Bypass (CVE-2018-10933), run with Isoloom
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul
85RISCO
abrir ↗VulnCheck XDB
initial-access
Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler
56RISCO
abrir ↗GitHub PoC★ 1
Defensive security checker for Citrix NetScaler ADC & Gateway — CVE-2026-88771 through CVE-2026-88778
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
100RISCO
abrir ↗GitHub PoC
Vulhub nginx/CVE-2013-4547: Nginx Filename Logic Vulnerability (CVE-2013-4547), run with Isoloom
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
35RISCO
abrir ↗VulnCheck XDB
initial-access
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
83RISCO
abrir ↗VulnCheck XDB
initial-access
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
83RISCO
abrir ↗GitHub PoC
CVE-2026-102422 POC
shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
48RISCO
abrir ↗GitHub PoC
0xCyp1337/CVE-2026-81780
WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability
48RISCO
abrir ↗GitHub PoC
CVE-2021-38759 — Raspberry Pi OS Default Credentials Exploit
Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. If not changed, attackers can gain a
28RISCO
abrir ↗GitHub PoC
CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RISCO
abrir ↗VulnCheck XDB
denial-of-service
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a
76RISCO
abrir ↗GitHub PoC
DOS infinite-loop Vulnerability POC
iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS
41RISCO
abrir ↗GitHub PoC★ 1
cve-2026-87902 lab
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗GitHub PoC
CVE-2026-59358 - Cloud Foundry UAA - High - Remote - Privilege leftover - user PKCE token as client_credentials Bearer
UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type
41RISCO
abrir ↗GitHub PoC
Benign, offline reproduction of CVE-2026-93355 — LiteLLM unverified-email JWT account takeover (runs LiteLLM's real code)
LiteLLM Weak JWT Authentication via Email-Based User Lookup
41RISCO
abrir ↗GitHub PoC
Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce
Undisclosed RCE in Zammad v6.3 and higher
83RISCO
abrir ↗GitHub PoC
CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RISCO
abrir ↗GitHub PoC
Case study: pyLoad CVE-2023-0297 (Click'n'Load jk evaluated by Js2Py). Demo only, not for use.
Code Injection in pyload/pyload
85RISCO
abrir ↗GitHub PoC★ 7
CVE-2026-21589 detector for Atlassian Data Center webresource traversal. Pre-auth webroot file read confirm for Jira, Confluence and Bitbucket.
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RISCO
abrir ↗GitHub PoC
Case study: Label Studio CVE-2022-36551 (task-import URL opened with urlopen). Demo only, not for use.
A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.
23RISCO
abrir ↗GitHub PoC★ 1
Smarty is vulnerable to code injection through template inheritance. Crafted assigned data can inject a forged SmartyNocache marker into regenerated PHP cache files, potentially allowing attackers to execute arbitrary PHP code. The issue affects Smarty 4.5.7 and earlier, and 5.8.4 and earlier.
Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache
48RISCO
abrir ↗VulnCheck XDB
initial-access
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISCO
abrir ↗GitHub PoC
在AI辅助下利用cve-2019-2215 完成OPPO A77t提权
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RISCO
abrir ↗GitHub PoC
Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison
Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison
33RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.