Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
88.052 exploits
GitHub PoC
Vulhub grafana/CVE-2021-43798: Grafana Plugin Path Traversal (CVE-2021-43798), run with Isoloom
Grafana path traversal
100RISCO
abrir ↗GitHub PoC
Atlassian Data Center Multiple Products - Arbitrary File Access (Path Traversal)
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RISCO
abrir ↗GitHub PoC
a proof of concept for the apache log4j Java logging library (CVE-2021-44228 vulnerability)
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
abrir ↗GitHub PoC★ 1
Detection PoC for CVE-2026-5430 — unauthenticated JWT algorithm bypass (CVSS 10.0) affecting WSO2 API Manager 4.1.0–4.6.0. Read-only assessment tool with patch confirmation and WAF detection. Authorized use only.
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
83RISCO
abrir ↗GitHub PoC
CVE-2026-21589 is a critical (CVSS 9.3) arbitrary file access vulnerability affecting all versions of eight Atlassian Data Center products, including Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, Fisheye, and Jira Service Management.
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RISCO
abrir ↗VulnCheck XDB
initial-access
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter
100RISCO
abrir ↗VulnCheck XDB
info-leak
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12
43RISCO
abrir ↗VulnCheck XDB
initial-access
Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.
60RISCO
abrir ↗VulnCheck XDB
initial-access
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and ea
100RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-21589 — Atlassian DC pre-auth arbitrary file read (CVSS 4.0 9.3). PoCbit PoC: atlassian-plugins-webresource ..:: traversal on /download/resources/ for Jira, Confluence, Bitbucket. check + exploit (WEB-INF/web.xml, crowd.properties). Batch JSONL, hits.txt. Not RCE. https://pocbit.org/pocs/cve-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RISCO
abrir ↗GitHub PoC
theendofabbys/CVE-2026-61424
Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2
48RISCO
abrir ↗VulnCheck XDB
remote-with-credentials
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
60RISCO
abrir ↗VulnCheck XDB
initial-access
Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST
50RISCO
abrir ↗GitHub PoC
Vulhub imagemagick/CVE-2016-3714: ImageTragick on a PHP upload page, run with Isoloom
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
100RISCO
abrir ↗GitHub PoC
Analisi e sfruttamento pratico della CVE-2026-46300 (Fragnesia) per l'ottenimento di Initial Access in un ambiente di test.
net: skbuff: preserve shared-frag marker during coalescing
91RISCO
abrir ↗GitHub PoC
Vulhub openssh/CVE-2018-15473: OpenSSH 7.7 Username Enumeration (CVE-2018-15473), run with Isoloom
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati
70RISCO
abrir ↗GitHub PoC
Vulhub opensmtpd/CVE-2020-7247: OpenSMTPD MAIL FROM Command Injection (CVE-2020-7247), run with Isoloom
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to
100RISCO
abrir ↗GitHub PoC
Vulhub laravel/CVE-2021-3129: Laravel Ignition RCE (CVE-2021-3129), run with Isoloom
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra
100RISCO
abrir ↗GitHub PoC★ 1
PoC: miniOrange OTP Verification <=5.5.7 unauthenticated Account Takeover via OTP re-routing (CVSS 9.8)
WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability
48RISCO
abrir ↗GitHub PoC
Drupal-miniorange_2fa
Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207
33RISCO
abrir ↗GitHub PoC
Vulhub httpd/CVE-2021-42013: Apache HTTP Server 2.4.50 Path Traversal and RCE (CVE-2021-42013), run with Isoloom
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RISCO
abrir ↗GitHub PoC★ 1
Hands-on vulnerability analysis and non-destructive verification of the vsftpd 2.3.4 backdoor (CVE-2011-2523) in an isolated lab.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISCO
abrir ↗GitHub PoC
Vulhub openssl/CVE-2014-0160: Heartbleed on nginx with OpenSSL 1.0.1c, run with Isoloom
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RISCO
abrir ↗GitHub PoC
Vulhub jetty/CVE-2021-28164: Jetty Ambiguous Path Information Disclosure (CVE-2021-28164), run with Isoloom
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contai
70RISCO
abrir ↗GitHub PoC
Vulhub php/CVE-2012-1823: PHP-CGI Query String Argument Injection (CVE-2012-1823), run with Isoloom
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
100RISCO
abrir ↗GitHub PoC
CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-102782 — OrdaSoft Joomla Simple Membership <7.4.0 unauth SQLi (CWE-89, CVSS 4.0 9.3). PoCbit PoC: checkLoginPass + login param extractvalue error leak. check/exploit/mass, hits.txt & exploited.txt. Fix 7.4.0+. https://pocbit.org/pocs/cve-2026-102782
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0
63RISCO
abrir ↗GitHub PoC★ 1
cve-2026-87902 lab
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗GitHub PoC★ 4
Privilege Escalation vulnerability
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
41RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.