Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
88.056 exploits
GitHub PoC
pwnVader/CVE-2026-17089-PoC-pwnVader
Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter
33RISCO
abrir ↗GitHub PoC
CVE-2026-93485
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
56RISCO
abrir ↗GitHub PoC
CVE-2026-68376 - Ubuntu Kernel 7.0.0-30
sctp: fix auth_hmacs array size in struct sctp_cookie
41RISCO
abrir ↗GitHub PoC★ 1
nmlz/CVE-2026-62878
Windows DNS Server Remote Code Execution Vulnerability
48RISCO
abrir ↗GitHub PoC
CVE-2026-93485
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
56RISCO
abrir ↗GitHub PoC
This project describes detailed information about the CVE-2026-51772 vulnerability.
A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multi
33RISCO
abrir ↗GitHub PoC
Improper Restriction of Rendered UI Layers or Frames (CWE-1021)
A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versi
28RISCO
abrir ↗GitHub PoC
griisemine/cve-2026-87902-detection
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗GitHub PoC
pwnVader/CVE-2026-87915-PoC-pwnVader
Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter
41RISCO
abrir ↗GitHub PoC★ 58
cve-2026-86060 PoC
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
78RISCO
abrir ↗GitHub PoC★ 4
POC-CVE-2026-93674 Authenticated Blind command injection proof of concept exploit code
Langflow OSS is affected by multiple vulnerabilities
68RISCO
abrir ↗GitHub PoC★ 1
HPLIP < 3.26.6 — Full admin takeover via PAPPL web interface (no auth). Related to CVE-2026-91097 through CVE-2026-91106 (CVSS 9.3)
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
41RISCO
abrir ↗GitHub PoC
pwnVader/CVE-2026-88877-PoC-pwnVader
Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
48RISCO
abrir ↗GitHub PoC
Laboratório de pentest em rede isolada: enumeração com nmap/nikto e exploração manual do Metasploitable2 (backdoor vsFTPd CVE-2011-2523, bindshell) com relatório técnico completo.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISCO
abrir ↗GitHub PoC★ 1
From-scratch exploit development in Python. No Metasploit. No frameworks. Raw socket-level implementation of real CVEs against authorized lab targets.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISCO
abrir ↗Metasploit300
Langflow AI Authentication Bypass
Langflow OSS is affected by multiple vulnerabilities
63RISCO
abrir ↗GitHub PoC
CVE-2026-93485
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
56RISCO
abrir ↗Metasploit600
Langflow AI Auth Blind Command Injection
Langflow OSS is affected by multiple vulnerabilities
68RISCO
abrir ↗GitHub PoC★ 1
WordPress Give Tributes CVE-2026-19658: Python 3 checker, FOFA helper, legacy Give form exploit path (CWE-502, CVSS 9.8).
Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter
48RISCO
abrir ↗GitHub PoC★ 45
PoC for CVE-2026-87902 — unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗GitHub PoC
CVE-2026-61628 - nginx-ignition - High 8.1 - Unauthenticated Privilege Escalation (Administrator Account Creation)
nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition
41RISCO
abrir ↗GitHub PoC★ 36
CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion (conditional RCE)
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗GitHub PoC★ 9
Unauthenticated RCE on Wordpress
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗VulnCheck XDB
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗VulnCheck XDB
initial-access
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
78RISCO
abrir ↗VulnCheck XDB
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗GitHub PoC★ 1
Neutralizing CISA active Linux kernel CVEs (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682) via modern eBPF, module disarmament, and containerd user namespaces.
netfilter: bridge: make ebt_snat ARP rewrite writable
71RISCO
abrir ↗GitHub PoC
Simple Checks to look for indicators of compromise
Directory Traversal and File upload allows execution of arbitrary script on the Management Server
100RISCO
abrir ↗GitHub PoC
pwnVader/CVE-2026-87902-PoC-pwnVader
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISCO
abrir ↗GitHub PoC
CVE-2026-13355 PoC — Meta Box AIO ≤3.11.0 unauthenticated admin privesc via MB Frontend Submission + User Profile shortcode chain. Python check/exploit, FOFA helper, mass scan with live flow.
Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter
48RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.