Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

84.127exploits catalogados

39.600CVEs com exploração pública

24.695testados em laboratório

Todos Referência 25.618Exploit-DB 24.485GitHub PoC 16.333VulnCheck XDB 9.678Nuclei 4.488Metasploit 3.525✓ só verificadosrecentes populares risco

16.153 exploits

GitHub PoC

Sanitized report summary and local PoC for CVE-2026-103441

CVE-2026-103441HIGH30 set 2026

Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing

41RISCO

abrir ↗

GitHub PoC

CVE-2026-76570 PoC (PoCbit) — Joomla JCTables (com_jctables) <1.21.1: unauth SQL read/write via front-end JSON API getdatarow/getrow (CVSS 4.0 10.0 AT:N). check + exploit + mass. https://www.cve.org/CVERecord?id=CVE-2026-76570

CVE-2026-76570CRITICAL30 set 2026

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1

48RISCO

abrir ↗

GitHub PoC

Sanitized report summary and local PoC for CVE-2026-103442

CVE-2026-103442HIGH30 set 2026

MergeAccount PHP object injection via session-key substitution

41RISCO

abrir ↗

GitHub PoC★ 1

Next.js next/og unauthenticated RCE (CVE-2026-94545) - PoC

CVE-2026-94545MEDIUM30 set 2026

Satori-generated SVG has improper escaping

33RISCO

abrir ↗

GitHub PoC

Sanitized report summary and local PoC for CVE-2026-103446

CVE-2026-103446HIGH30 set 2026

WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments

41RISCO

abrir ↗

GitHub PoC

CVE-2026-12227 is a critical (CVSS 9.8) unauthenticated Local File Inclusion (LFI) vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including 45.16.0, This can lead to sensitive data exposure, access control bypass, or even full Remote Code Execution (RCE).

CVE-2026-12227CRITICAL30 set 2026

Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter

63RISCO

abrir ↗

GitHub PoC

Sanitized Cargo report and patch verification notes for CVE-2026-96874.

CVE-2026-96874LOW29 set 2026

Stored XSS in Cargo Drilldown tab names

28RISCO

abrir ↗

GitHub PoC

kiyingiericmark-wq/CVE-2020-24186

CVE-2020-24186CRITICAL29 set 2026

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo

85RISCO

abrir ↗

GitHub PoC

A detection/hunting script for compromise related to CVE-2026-88771

CVE-2026-88771CRITICALsob ataque29 set 2026

A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

78RISCO

abrir ↗

GitHub PoC

Sanitized CirrusSearch report and patch verification notes for CVE-2026-96873.

CVE-2026-96873MEDIUM29 set 2026

Reflected XSS in CirrusSearch debug explain output

33RISCO

abrir ↗

GitHub PoC

CVE-2026-85520 PoC (PoCbit) — PrestaShop MyPresta gmfeed ≤2.3.9 unauthenticated arbitrary file write via feed.php (Save to file URL) → RCE. check + exploit + mass bulk (--list -j). https://pocbit.org/pocs/cve-2026-85520

CVE-2026-85520CRITICAL29 set 2026

Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

48RISCO

abrir ↗

GitHub PoC

container escape POCs for CVE-2026-80521 and CVE-2026-52910

CVE-2026-80521HIGH29 set 2026

af_unix: Unlink scc_entry in unix_del_edge().

41RISCO

abrir ↗

GitHub PoC★ 1

Unauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) — a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Includes Docker Compose lab setup and a Python exploitation script. For authorized security research only.

CVE-2026-63030CRITICALsob ataque29 set 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RISCO

abrir ↗

GitHub PoC

Sanitized Cargo report and patch verification notes for CVE-2026-96875.

CVE-2026-96875MEDIUM29 set 2026

Reflected XSS in Cargo Drilldown hierarchy filters

33RISCO

abrir ↗

GitHub PoC

Published Epson EH-TW5350 CVE · Hard-coded credentials · B-BEAM-BOB team

CVE-2021-43717CRITICAL29 set 2026

An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector equipped with an iProjection

48RISCO

abrir ↗

GitHub PoC

Published Epson EH-TW5350 CVE · Web Control authentication bypass · B-BEAM-BOB team

CVE-2021-43718MEDIUM29 set 2026

An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malici

33RISCO

abrir ↗

GitHub PoC

Published Epson EH-TW5350 CVE · Firmware update verification bypass · B-BEAM-BOB team

CVE-2021-43716CRITICAL29 set 2026

Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector

48RISCO

abrir ↗

GitHub PoC

CVE-2026-101110 PoC: OrdaSoft Joomla Book Library (Free) <=6.4.6 unauth SQLi — field/direction ORDER BY, session prime + `-- xselect` blacklist bypass (com_booklibrary). Colored check + mass exploit, CVSS 9.3. https://pocbit.org/pocs/cve-2026-101110

CVE-2026-101110CRITICAL29 set 2026

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6

48RISCO

abrir ↗

GitHub PoC★ 1

PoC / Exploit for CVE-2025-32463(sudo LPE)

CVE-2025-32463CRITICALsob ataque29 set 2026

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RISCO

abrir ↗

GitHub PoC★ 10

Docker lab for validating CVE-2026-84383 in libheif through Discourse

CVE-2026-84383CRITICAL29 set 2026

libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items

48RISCO

abrir ↗

GitHub PoC

CVE-2026-8065 PoC: Hitachi Energy RTU500 unauth firmware update bypass (CWE-306, CVSS 9.1). IoT/OT colored check + mass exploit — RTU500 fingerprint, firmware endpoint probe, lab-safe upload test. https://pocbit.org/pocs/cve-2026-8065

CVE-2026-8065CRITICAL29 set 2026

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions all

48RISCO

abrir ↗

GitHub PoC

CVE-2026-100752 PoC: OrdaSoft Joomla Real Estate Manager (Free) <=6.7.8 unauth SQLi via order_field ORDER BY (com_realestatemanager). Colored check + mass exploit, version fingerprint, PoCbit https://pocbit.org/pocs/cve-2026-100752

CVE-2026-100752CRITICAL29 set 2026

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9

48RISCO

abrir ↗

GitHub PoC

Sanitized Cargo report and patch verification notes for CVE-2026-96876.

CVE-2026-96876MEDIUM29 set 2026

Anonymous reflected XSS in CargoExport invalid-alias errors

33RISCO

abrir ↗

GitHub PoC★ 51

Next.js RCE

CVE-2026-94545MEDIUM29 set 2026

Satori-generated SVG has improper escaping

33RISCO

abrir ↗

GitHub PoC

CVE-2026-101894 PoC: @xhmikosr/decompress symlink-chain archive path traversal (bypass CVE-2026-53486). Node lab + lockfile scan + mass evil.tar upload exploit. CVSS 9.1. https://pocbit.org/pocs/cve-2026-101894

CVE-2026-101894CRITICAL29 set 2026

@xhmikosr/decompress: Path traversal via symlink chain

48RISCO

abrir ↗

GitHub PoC

CVE-2026-101108 PoC: OrdaSoft Joomla Vehicle Manager (Free) <=6.5.7 unauth SQLi — order_field/order_direction unquoted ORDER BY (com_vehiclemanager). Colored check + mass exploit, CVSS 9.3. https://pocbit.org/pocs/cve-2026-101108

CVE-2026-101108CRITICAL29 set 2026

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8

48RISCO

abrir ↗

GitHub PoC★ 5

XWP_RCE — CVE-2026-87902 Hacker Console

CVE-2026-87902HIGHsob ataque29 set 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

98RISCO

abrir ↗

GitHub PoC

CVE-2025-24813 Apache Tomcat 11 1-day vulnerability research lab

CVE-2025-24813CRITICALsob ataque29 set 2026

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RISCO

abrir ↗

GitHub PoC

https://vuldb.com/cve/CVE-2026-102261

CVE-2026-102261MEDIUM29 set 2026

owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization

33RISCO

abrir ↗

GitHub PoC

Sanitized WikiLambda report and patch verification notes for CVE-2026-96872.

CVE-2026-96872LOW29 set 2026

WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions

28RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.