Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
88.056 exploits
GitHub PoC★ 4
A POC for CVE-2026-94129
BioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-where
48RISCO
abrir ↗GitHub PoC
A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing unauthenticated attackers to gain root-level WHM access by injecting CRLF sequences into server-side session files via the Authorization header — no credentials required.
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISCO
abrir ↗GitHub PoC★ 23
DJI Drone DUML Command Injection over Bluetooth — Proof of Concept for CVE-2026-78306
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
41RISCO
abrir ↗GitHub PoC
o-sec/CVE-2026-41452-poc
Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup
63RISCO
abrir ↗GitHub PoC
CVE-2021-43798 Grafana Unauthenticated Path Traversal - Security Lab | Shivam Gupta | 23104003
Grafana path traversal
100RISCO
abrir ↗GitHub PoC
Unauthenticated Arbitrary Shortcode Execution
WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
48RISCO
abrir ↗GitHub PoC
suominen/CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
71RISCO
abrir ↗GitHub PoC
CVE-2026-36213: MEmu Android Emulator 9.2.7.0 Local Privilege Escalation
An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.e
41RISCO
abrir ↗GitHub PoC
A PoC for CVE-2026-71217
Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion
41RISCO
abrir ↗GitHub PoC★ 5
DJI Drone Cleartext Bluetooth Transmission of Wi-Fi PSK and Session UUID — Proof of Concept for CVE-2026-77812.
Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE
48RISCO
abrir ↗GitHub PoC
CVE-2026-36213: MEmu Android Emulator 9.2.7.0 Local Privilege Escalation
An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.e
41RISCO
abrir ↗GitHub PoC
mfahdk/CVE-2026-39987_RCE_PoC
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISCO
abrir ↗GitHub PoC
ZTE SmartLife security findings leading to account takeover: 100K+ Google Play downloads and CVE-2026-86552 through CVE-2026-86555.
A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP
33RISCO
abrir ↗GitHub PoC
shambhaviM18/cve-2019-15107-lab
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RISCO
abrir ↗VulnCheck XDB
initial-access
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RISCO
abrir ↗GitHub PoC★ 2
CVE-2026-88854 — OrdaSoft Joomla Gallery unauth SQLi PoC (check / mass scan / EXTRACTVALUE read)
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
48RISCO
abrir ↗GitHub PoC★ 7
Proof-of-concept and instrumented reproduction harness for CVE-2026-28609, an out-of-bounds write in Android's MatroskaExtractor reachable via a crafted WebM file with a big-endian PCM audio track.
In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to re
41RISCO
abrir ↗VulnCheck XDB
info-leak
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baske
48RISCO
abrir ↗GitHub PoC★ 2
D-Link R95 (BE9500) DHMAPI SetTimeSettings command injection -> root RCE PoC (CVE-2026-93958); for authorized testing
D-Link R95 DHMAPI ssi system os command injection
48RISCO
abrir ↗VulnCheck XDB
initial-access
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISCO
abrir ↗GitHub PoC
CVE-2026-77635 - CakePHP - Critical 9.2 - Unauthenticated GET /?path= - SQL Injection
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
48RISCO
abrir ↗GitHub PoC★ 4
CVE-2026-92229 — Forminator ≤1.57.2 unauth shortcode exec (current_url / quiz AJAX). Python 3 PoC.
Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
48RISCO
abrir ↗VulnCheck XDB
initial-access
Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
48RISCO
abrir ↗VulnCheck XDB
initial-access
Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
63RISCO
abrir ↗GitHub PoC★ 2
PoC for CVE-2026-89274: unauthenticated arbitrary shortcode execution in WP Recipe Maker ≤10.8.1 via recipe rating comments (JSON-LD). Python check/exploit/verify.
WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
48RISCO
abrir ↗GitHub PoC
CVE-2026-19952 - DynamiApps - High 7.5 - Unauthenticated POST /wp-admin/admin-ajax.php - Arbitrary File Deletion
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag
41RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.