Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
88.056 exploits
GitHub PoC
UVdesk unauth wizard super-admin POC
UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard
28RISCO
abrir ↗GitHub PoC
Issabel pbxapi hard coded JWT RCE POC
Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate
63RISCO
abrir ↗GitHub PoC★ 4
PoC for CVE-2026-67401 — cPanel/WHM EmailTrack SQL injection leading to arbitrary file write and root RCE. Includes a self-contained vulnerable lab, SQLi detection, and full exploit chain.
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTr
48RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-85706 – GitLab Unauth File Read Toolkit (CVSS 10.0) | Red/Blue Team suite for self-managed GitLab CE/EE 18.7–19.3.1. 2 tools: Full Exploit (unauth file read, admin token, mass scan, loot, shell, stealth, SQLite/HTML/JSON output) etc., SafeChecker (version detect, audit, security headers, TLS check, MITRE). Only Use Ethically, Educ. <3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISCO
abrir ↗GitHub PoC
CVE-2026-12793 - JetFormBuilder Unauthorized RCE (CRITICAL 9.8)
JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
48RISCO
abrir ↗GitHub PoC★ 1
exploit para reverse shell en MCPJamInspector v1.4.2< por endpoint mal configurado
REC in MCPJam inspector due to HTTP Endpoint exposes
75RISCO
abrir ↗GitHub PoC
CVE-2026-85706
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-87930 Joomla Multi-CVE RCE suite — authorized testing only
MaxSite CMS through 109.6 PHP Object Injection via ci_session
48RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-87796 - Multi Uploader for Gravity Forms <= 1.1.9; Unauthorized RCE (CRITICAL 9.8)
Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload
48RISCO
abrir ↗GitHub PoC★ 1
SneakyNachos/CVE-2026-85045
Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside
41RISCO
abrir ↗GitHub PoC
CVE-2026-19975 - Draft or TODO
Azuriom CMS Money Transfer ProfileController.php transferMoney toctou
28RISCO
abrir ↗GitHub PoC★ 2
CVE-2026-76460
Cisco Identity Services Engine Authentication Bypass Vulnerability
100RISCO
abrir ↗VulnCheck XDB
info-leak
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISCO
abrir ↗GitHub PoC
Isolated educational FreePBX-compatible cyber range for CVE-2025-57819 (CWE-89/CWE-288). Docker lab — not official Sangoma FreePBX.
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RISCO
abrir ↗VulnCheck XDB
initial-access
WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability
48RISCO
abrir ↗VulnCheck XDB
initial-access
Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
100RISCO
abrir ↗GitHub PoC★ 2
Unbounded memory allocation in NanaZip's UFS handler via an attacker-controlled `fs_bsize` field.
NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields
28RISCO
abrir ↗GitHub PoC★ 1
SneakyNachos/CVE-2026-85048-the-gpu-died
Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the
41RISCO
abrir ↗GitHub PoC
A Python-based security tool for checking sudo versions for potential exposure to CVE-2021-3156 (Baron Samedit). Designed for authorized security testing and learning.
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISCO
abrir ↗GitHub PoC★ 3
Unbounded memory allocation in NanaZip's UFS handler via an attacker-controlled `fs_bsize` field.
NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields
28RISCO
abrir ↗VulnCheck XDB
info-leak
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RISCO
abrir ↗GitHub PoC★ 1
My first CVE
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoi
33RISCO
abrir ↗GitHub PoC★ 1
Issabel pbxapi hard coded JWT RCE POC
Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate
63RISCO
abrir ↗GitHub PoC
Information on the security content of Apple software updates
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS
33RISCO
abrir ↗GitHub PoC★ 3
Proof of Concept and Write-up for CVE-2026-56096 (Blind Parameter Injection in TYPO3 EXT:solr)
Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
33RISCO
abrir ↗GitHub PoC★ 526
A cPanel and WHM authentication bypassing tool
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.