Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
88.056 exploits
GitHub PoC
CVE-2026-79752 - CakePHP - Critical 9.2 - Unauthenticated GET /?type= - SQL Injection
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
48RISCO
abrir ↗VulnCheck XDB
initial-access
Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
63RISCO
abrir ↗GitHub PoC
Standalone authorized universal HTTP PoC for CVE-2026-75157
Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)
41RISCO
abrir ↗GitHub PoC
PoC for CVE-2026-84434: unauthenticated arbitrary file upload in Gravity Forms ≤3.1.0.4 via hidden File Upload fields. Python check/exploit/mass scan.
Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
63RISCO
abrir ↗GitHub PoC
IDOR/BOLA in Events Manager <= 7.4.3 REST ticket update endpoint — CVE-2026-93661
Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR
28RISCO
abrir ↗GitHub PoC
MohammadAliMehri/cve-2021-44790-lab
Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier
45RISCO
abrir ↗GitHub PoC
Stored XSS in Concrete CMS Community Store leads to admin dashboard takeover
Concrete CMS Community Store before 2.7.8 Stored XSS
41RISCO
abrir ↗GitHub PoC
abhaybansal16/cve-2025-55182-lab
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC★ 2
PoC for CVE-2026-89274: unauthenticated arbitrary shortcode execution in WP Recipe Maker ≤10.8.1 via recipe rating comments (JSON-LD). Python check/exploit/verify.
WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
48RISCO
abrir ↗GitHub PoC★ 2
CVE-2026-81294 - WordPress - Critical 9.8 - Unauthenticated Privilege Escalation
WordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability
48RISCO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC
CVE-2026-13447 - WordPress - inspireui - Critical 9.8 - Unauthenticated POST /wp-json/api/flutter_user/firebase_sms_v2 - Authentication Bypass
MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery
48RISCO
abrir ↗GitHub PoC★ 4
CVE-2026-92229 — Forminator ≤1.57.2 unauth shortcode exec (current_url / quiz AJAX). Python 3 PoC.
Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
48RISCO
abrir ↗GitHub PoC
CVE-2026-19952 - DynamiApps - High 7.5 - Unauthenticated POST /wp-admin/admin-ajax.php - Arbitrary File Deletion
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag
41RISCO
abrir ↗GitHub PoC
CVE-2026-75816 - Frontend Admin by DynamiApps for Wordpress - Critical 9.8 - Unauthenticated POST /wp-admin/admin-ajax.php - Account Takeover
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier
48RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-32475 — unauthenticated arbitrary file upload in Elementor Pro <= 4.2.1 (CVSS 9.0, CWE-434). PoC for authorised testing.
WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
63RISCO
abrir ↗GitHub PoC
djzzlim/CVE-2026-94036
D-Link DIR-X1860/DIR-X1860Z routerd ubus access control
41RISCO
abrir ↗GitHub PoC★ 1
Trained to Escalate: Forensic Analysis and Local Replication of RLHF-Induced Privilege Escalation in AI Agents (CVE-2026-65616)
Potential privilege escalation to JFrog administrator privileges
41RISCO
abrir ↗GitHub PoC
CVE-2026-18937 - Broken Link Checker - Critical 9.0 - Unauthenticated GET /?page_id=4&shortcode_tags[blcpoc]=po... - Remote Code Execution
Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection
63RISCO
abrir ↗VulnCheck XDB
initial-access
The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
48RISCO
abrir ↗GitHub PoC
CVE-2026-81648 - WordPress - CryptoPayment Gateway - Critical 10.0 - Unauthenticated POST /wp-content/plugins/cryptopayment-gateway/vendor/cryptd/ajax.php - Arbitrary File Deletion
CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router
48RISCO
abrir ↗GitHub PoC
Device-bound CVE-2026-64560 adaptation for RedMi K80pro miro OS 3.0.304.0
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
41RISCO
abrir ↗GitHub PoC
Tracking DiagSpill (CVE-2026-74469), the Linux kernel SCTP sock_diag heap overflow
sctp: prevent peer transport count overflow
41RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.