Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
88.056 exploits
GitHub PoC
Hasyros/CVE-2026-101162-xss-wp-ultimate-review
WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings
33RISCO
abrir ↗GitHub PoC★ 1
jvidhan/cve-2026-28912
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.7
41RISCO
abrir ↗GitHub PoC
Hasyros/CVE-2026-101161-dos-wp-ultimate-review-shortcode
WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode
41RISCO
abrir ↗GitHub PoC★ 8
One-click temporary KernelSU root (late-load) for Samsung Galaxy via DirtyFrag (CVE-2026-43284). No Shizuku/PC/ADB.
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISCO
abrir ↗VulnCheck XDB
initial-access
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
48RISCO
abrir ↗VulnCheck XDB
initial-access
Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
63RISCO
abrir ↗GitHub PoC
CVE-2024-4367 proof PDF for cpc docs-preview
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RISCO
abrir ↗GitHub PoC★ 13
CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints Gateway, build vs 14.1-73.37 / 13.1-64.23, UDP/443 DTLS probe. CTX697096; active exploitation reported. https://pocbit.org/pocs/cve-2026-88772
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
100RISCO
abrir ↗GitHub PoC★ 9
CVE-2026-67279 + CVE-2026-86060 – MikroTrick MikroTik RouterOS SSH Pre-Auth Takeover (CVSS 9.2) | Red/Blue Team suite. 2 tools: Full Exploit (rekey bypass, fd-2 policy swap, full-admin shell, plant, mass scan, SOCKS5/Tor, stealth) & SafeDetect (banner/version audit, IoC guidance, JSON/CSV/HTML). Use Ethically & Safety only.
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
63RISCO
abrir ↗GitHub PoC
CVE-2026-88008 - Traefik (<=2.11.56 / <=3.7.12): a client-controlled h2c upgrade tunnels past routers and middleware (BasicAuth/ForwardAuth/IPAllowList), unauthorised access + no access logging. Stdlib-only Python PoC + real Jetty h2c lab, verified on v3.7.12 vs v3.7.13.
Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
41RISCO
abrir ↗GitHub PoC
Alexandertanay/jenkins-cve-2024-23897-lab
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an
100RISCO
abrir ↗GitHub PoC
CVE-2020-14008 — ManageEngine Applications Manager Remote Code Execution
Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in
35RISCO
abrir ↗GitHub PoC
snapshot of logpresso/CVE-2021-44228-Scanner at a pinned commit, for cross platform ci legs
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
abrir ↗GitHub PoC★ 1
Unauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) — a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Includes Docker Compose lab setup and a Python exploitation script. For authorized security research only.
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗GitHub PoC
A Windows-friendly, non-destructive Python checker for detecting WordPress installations potentially affected by CVE-2026-14281.
Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
48RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-39987 Marimo Pre-auth RCE research, Docker lab reproduction, root cause analysis, and patch validation.
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISCO
abrir ↗GitHub PoC
CVE-2026-8712: Unauthenticated SSRF / Backend URI Override in Wyoming HTTP API via uri Query Parameter
Wyoming < 1.10.2 SSRF via uri Query Parameter
33RISCO
abrir ↗GitHub PoC★ 10
三星 Galaxy S25 Ultra（SM-S938B）适配版 DFRoot：开机自动获取 root（DirtyFrag CVE-2026-43284 + CVE-2026-43499 双链路），全中文界面，fork 自 diabl0w/DFRoot
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISCO
abrir ↗Metasploit300
Citrix NetScaler Unauthenticated Login Log Command Injection (CVE-2026-88771)
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
100RISCO
abrir ↗Metasploit300
Citrix NetScaler Unauthenticated Login Log Command Injection (CVE-2026-88771)
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
100RISCO
abrir ↗Metasploit300
Citrix NetScaler Unauthenticated Login Log Command Injection (CVE-2026-88771)
HTTP Request Smuggling
63RISCO
abrir ↗GitHub PoC★ 1
Unauthenticated LFI and conditional RCE scanner for CVE-2026-87902 in WordPress Core (4.7.0 – 7.1.1).
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗GitHub PoC★ 1
Defensive WordPress security scanner for CVE-2026-87902 — local filesystem inspection and safe remote HTTP/HTTPS assessment.
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗GitHub PoC★ 2
Exploit para explotar la vulnerabilidad CVE-2026-87902 que se acontece en el core de WordPress
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗GitHub PoC★ 11
watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
100RISCO
abrir ↗GitHub PoC
Universal container escape exploit targeting the CRIU container checkpoint/restore system - CVE-2026-18107
Criu: criu: container escape via rseq critical section hijack during checkpoint/restore
41RISCO
abrir ↗GitHub PoC★ 1
Security research and SOC investigation of CVE-2026-39987 using Docker, Nginx, Linux process monitoring, Splunk SIEM, and SPL detection rules.
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISCO
abrir ↗GitHub PoC★ 22
watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
100RISCO
abrir ↗GitHub PoC
CVE-2026-100835 PoC: Edgeless Contrast <1.16.0 remote attestation relay (aTLS / CWE-295). Manifest audit (AllowedChipIDs/AllowedPIIDs), version & coordinator probe. https://pocbit.org/pocs/cve-2026-100835
Contrast before 1.16.0 Remote Attestation Relay Attack
48RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.