Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
88.056 exploits
GitHub PoC
LetsDefend SOC lab investigating CVE-2024-49138 exploitation and related malicious activity.
Windows Common Log File System Driver Elevation of Privilege Vulnerability
76RISCO
abrir ↗GitHub PoC
jvidhan/cve-2026-43687
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadO
33RISCO
abrir ↗GitHub PoC★ 7
MikroTik RouterOS PoC Collection - CVE-2026-86060 - CVE-2026-67279 - CVE-2026-67276 RouterOS SSH
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
78RISCO
abrir ↗GitHub PoC★ 2
CVE-2026-5430 - WSO2 API Manager - Critical 10.0 - Unauthenticated Account Takeover - WSO2 API Control Plane, WSO2 API Manager, WSO2 Traffic Manager, WSO2 Universal Gateway
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
83RISCO
abrir ↗GitHub PoC
CVE-2026-65660 - Draft or TODO
Microsoft SharePoint Server Remote Code Execution Vulnerability
71RISCO
abrir ↗GitHub PoC★ 3
Proof of concept for vulnerability CVE-2026-87902 in Wordpress
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗VulnCheck XDB
client-side
Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting
21RISCO
abrir ↗GitHub PoC
CVE-2026-96512 - sudo - High 7.8 - Authenticated LOCAL TZ=UTC+14 sudo -n /usr/bin/id - Local Privilege Escalation via Time-Window Bypass
Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
41RISCO
abrir ↗GitHub PoC
Ermensonx/sudotimewarp-cve-2026-96512-
Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
41RISCO
abrir ↗VulnCheck XDB
client-side
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
56RISCO
abrir ↗GitHub PoC
Proof of concept for vulnerability CVE-2026-87902 in Wordpress
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗VulnCheck XDB
initial-access
D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface
48RISCO
abrir ↗VulnCheck XDB
initial-access
CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router
48RISCO
abrir ↗VulnCheck XDB
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗GitHub PoC
technical research & analysis on linux process execution, SUID privilege escalation, LD_PRELOAD hooking, and CVE-2014-6271 (shellshock).
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISCO
abrir ↗GitHub PoC
WordPress CVE-2026-87902 diagnostic check
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗GitHub PoC
WP Plainview Activity Monitor auth RCE fix: broken manual cookie parse to stable Session handling. CVE-2018-15877 educational fix.
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell meta
60RISCO
abrir ↗GitHub PoC
Penetration testing report and PoC on Metasploitable2 target, demonstrating CVE-2011-2523 vsFTPd v2.3.4 exploitation via Metasploit.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISCO
abrir ↗VulnCheck XDB
client-side
WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability
41RISCO
abrir ↗VulnCheck XDB
initial-access
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
83RISCO
abrir ↗GitHub PoC
CVE-2026-79417 PoC
Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privile
33RISCO
abrir ↗GitHub PoC
Samba 3.0.20 username map script command injection exploit — reverse shell via SMB authentication, built from scratch in Python using impacket. No Metasploit.
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands
50RISCO
abrir ↗GitHub PoC
Benign, self-contained reproduction of CVE-2026-61732 (Decepticon ChatML role-boundary forgery)
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
48RISCO
abrir ↗GitHub PoC
Unauthenticated IDOR in Bookly ≤ 28.2: bookly_get_form_id + bookly_render_complete leak any order’s bookly_order token; bookly_add_to_calendar exposes appointments; bookly_rollback_order cancels/deletes non-completed bookings. CVSS 9.1. Python check/exploit PoC — pocbit.org/pocs/cve-2026-93399
Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
48RISCO
abrir ↗GitHub PoC★ 65
Comment2Shell is a zero click pre auth RCE exploit for WordPress CVE-2026-93485. An anonymous comment plants stored XSS that fires when an admin views the post and drops a self deleting webshell. Full chain PoC with scanner interactive shell Nuclei template and Docker
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
56RISCO
abrir ↗GitHub PoC
CVE-2026-12227 - Visual Composer <= 45.16.0 unauthenticated LFI via vcv-template (CVSS 9.8): Docker validation lab, safe-oracle PoC, nuclei template. Root cause: validate-then-mutate on the theme: prefix. Verified: vendor fix never landed - fires through 45.16.3 on WP <= 7.1.1; masked by WP 7.1.2 core gate.
Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
63RISCO
abrir ↗GitHub PoC
zyphorixofficialmain-lab/cve-2026-87902
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗GitHub PoC★ 1
whoami-012/CVE-2026-96515
Command Injection Vulnerability in Netlink ICT HG323RW Router
41RISCO
abrir ↗GitHub PoC
Temporary fork of braces with a minimal security patch for CVE-2026-93687, created only to validate dependency override behavior and Fortify/FoD detection before moving the fix to an official Bentobox-owned source.
braces through 3.0.3 Stack Overflow via Deeply Nested Patterns
41RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.