Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
88.056 exploits
GitHub PoC
watchtowrlabs/citrix-netscaler-cve-2026-88771-iocs
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
100RISCO
abrir ↗GitHub PoC
Divi Membership (DiviEngine) pre-auth admin takeover — CVE-2026-19660 paypal_param bypass. Python PoC with exploit + cookie export.
Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter
48RISCO
abrir ↗GitHub PoC
Defensive analysis, patch breakdown, and detection scanner for CVE-2026-14378 (WordPress DevKit Pro Plugin <= 2.3.0).
DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow
48RISCO
abrir ↗GitHub PoC
Defensive analysis, detection scanner, and rule signatures for CVE-2026-94541 (WPMobile.App <= 11.82).
WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter
48RISCO
abrir ↗GitHub PoC★ 2
Sensitive info disclosure via info API in PictShare < 3.7.1 (CWE-522). PoC + advisory writeup.
PictShare < 3.7.1 Sensitive Information Disclosure via info API
41RISCO
abrir ↗GitHub PoC★ 2
Predictable delete_code via rand() in PictShare < 3.7.1 (CWE-338). PoC + advisory writeup.
PictShare < 3.7.1 Predictable Delete Code via rand()
41RISCO
abrir ↗GitHub PoC★ 1
Unauthenticated RCE in Yamcs mission control via YAML injection in reconfigureInstance()
Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)
28RISCO
abrir ↗GitHub PoC
Meniben/redmi14c-pond-cve-2026-64560
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
41RISCO
abrir ↗VulnCheck XDB
initial-access
WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
63RISCO
abrir ↗VulnCheck XDB
initial-access
Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values
63RISCO
abrir ↗VulnCheck XDB
initial-access
Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values
63RISCO
abrir ↗VulnCheck XDB
initial-access
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
100RISCO
abrir ↗VulnCheck XDB
initial-access
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 thro
100RISCO
abrir ↗GitHub PoC
Exploitability PoC for CVE-2026-102-268 (PyJWT Asymmetric-PEM detection bypass).
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
48RISCO
abrir ↗GitHub PoC★ 6
A python tool to detect PDF files exploiting CVE-2026-86950
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS
76RISCO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC
NetScaler CTX697096 Threat Hunt Helper (IoC scanner) - CVE-2026-88771, CVE-2026-88772, CVE-2026-88779
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
100RISCO
abrir ↗VulnCheck XDB
initial-access
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce
63RISCO
abrir ↗GitHub PoC
Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php
FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php
33RISCO
abrir ↗GitHub PoC
CVE-2026-62146 CRI-O ShmPath poisoning PoC and exploit
Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket
41RISCO
abrir ↗GitHub PoC★ 15
VC-Strike — VMware vCenter CVE-2026-59310 (unauth root RCE) & CVE-2026-59309 (SRP auth bypass) authorized pentest suite. GUI+CLI, multi-session C2, stdlib-only. 授权测试专用
vCenter directory-traversal vulnerability
90RISCO
abrir ↗GitHub PoC★ 1
REDCap DataImport RCE
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce
63RISCO
abrir ↗GitHub PoC
CVE-2026-92966 — WordPress LatePoint ≤5.7.0 unauthenticated stored shortcode execution (CVSS 9.1, CWE-94). PoCbit mass-exploit PoC: plant [caption]/custom shortcode in booking first name → Customer Cabinet block double do_shortcode; fixed in 5.7.1. No API key. check/exploit/mass, hits.txt & exploited.txt, https://pocbit.org/pocs/cve-2026-92966
Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field
48RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.