Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
88.056 exploits
GitHub PoC★ 3
CVE-2026-87902 — WordPress Core LFI → RCE by Hackfut
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-38526 - Authenticated RCE exploit for Krayin CRM <= 2.2.x. Upload arbitrary PHP via /admin/tinymce/upload and gain remote code execution. Python PoC for security researchers, CTF players and bug bounty hunters. Tested on HTB Nexus.
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a
48RISCO
abrir ↗GitHub PoC
Hasyros/CVE-2026-101162-xss-wp-ultimate-review
WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings
33RISCO
abrir ↗GitHub PoC★ 178
🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, deep vulnerability validation, and DevSecOps-ready security auditing workflows.
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
63RISCO
abrir ↗GitHub PoC
Proof-of-Concept for CVE-2026-18110
Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, username
56RISCO
abrir ↗GitHub PoC
Out-of-bounds Write (CWE-787)
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS
76RISCO
abrir ↗GitHub PoC
Hands-on cybersecurity and CTF labs covering port reconnaissance, CMS stack discovery, VulnCMS, CVE-2026-58225, shell-to-root paths, Python, sudo, user switching, passwords, and post-exploitation.
SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service
28RISCO
abrir ↗GitHub PoC★ 23
ZeroDayEvil/CVE-2026-62911
Microsoft Exchange Server Elevation of Privilege Vulnerability
41RISCO
abrir ↗GitHub PoC★ 1
Request a Quote for WooCommerce (Addify) <= 2.9.2 Unauthenticated arbitrary file upload via afrfq_submit_quote_via_popup
Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
63RISCO
abrir ↗VulnCheck XDB
initial-access
Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field
63RISCO
abrir ↗GitHub PoC★ 22
Am I fixed? Was I hacked? Read-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771–88778), CTX697174, CTX697191 (SAML RCE) and CTX697263 php2shell (fixed in 14.1-73.49 / 13.1-64.32): build, CVE preconditions, SAML, mgmt exposure, MFA, upgrade risks + IoC sweep with every public IoC (webshells, implants, 133 attacker IPs).
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
100RISCO
abrir ↗GitHub PoC★ 3
The Events Calendar Wordpress Plugin Mass Exploit CVE-2026-78006 & CVE-2026-78159
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
48RISCO
abrir ↗GitHub PoC
CVE-2026-100721 PoC: vm2 <3.12.2 NodeVM external allowlist bypass → sandbox escape / host RCE. Local Node lab (evil-left-pad), remote sandbox API mass exploit, colorful CLI. PoCbit — https://pocbit.org/pocs/cve-2026-100721
vm2 before 3.12.2 Authorization Bypass via Custom Resolver
48RISCO
abrir ↗GitHub PoC
CVE-2026-82384 PoC: Apache Roller 6.1.5 unauthenticated XML-RPC ex:serializable Java deserialization (pre-auth RCE). Check, ysoserial exploit, mass bulk scanning, colored CLI. PoCbit — https://pocbit.org/pocs/cve-2026-82384
Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint
48RISCO
abrir ↗VulnCheck XDB
initial-access
Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
60RISCO
abrir ↗VulnCheck XDB
initial-access
Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key
48RISCO
abrir ↗GitHub PoC★ 1
jvidhan/cve-2026-28912
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.7
41RISCO
abrir ↗GitHub PoC
CVE-2026-88772 - Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS)
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
100RISCO
abrir ↗GitHub PoC★ 8
One-click temporary KernelSU root (late-load) for Samsung Galaxy via DirtyFrag (CVE-2026-43284). No Shizuku/PC/ADB.
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISCO
abrir ↗GitHub PoC
SuiteCRM <= 7.15.1, <= 8.10.1 - Authenticated SSRF
SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure
56RISCO
abrir ↗VulnCheck XDB
initial-access
Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
63RISCO
abrir ↗GitHub PoC★ 22
ZeroDayEvil/CVE-2026-24061
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISCO
abrir ↗GitHub PoC
Thesis scenario test (research only): Scenario C: EPSS-BLOCK path - node-serialize@0.0.4 CVE-2017-5941
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() fu
35RISCO
abrir ↗VulnCheck XDB
client-side
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
46RISCO
abrir ↗GitHub PoC
Hasyros/CVE-2026-101160-dos-wp-ultimate-review-rating
WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating
41RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-87902 — WordPress Core LFI → RCE
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗VulnCheck XDB
initial-access
Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
63RISCO
abrir ↗GitHub PoC
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
100RISCO
abrir ↗GitHub PoC★ 28
ZeroDayEvil/CVE-2026-41940-PoC
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISCO
abrir ↗GitHub PoC★ 1
Tooling related to CVE-2026-88771 and CVE-2026-88772
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.