Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
88.056 exploits
GitHub PoC
BrainBob/CVE-2026-76578
Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci
48RISCO
abrir ↗GitHub PoC
CVE-2026-67401 cPanel & WHM EmailTrack SQL Injection — IOC scanner, compromise detection, patch verification, incident response and remediation toolkit.
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTr
48RISCO
abrir ↗GitHub PoC
CVE-2026-79387-PbootCMS-SQL-Injection
SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary us
33RISCO
abrir ↗GitHub PoC★ 3
SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress; SMS Alert <3.9.6; Unauthenticated Privilege Escalation (Forced Password Reset)
SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
63RISCO
abrir ↗GitHub PoC★ 3
poc in python for CVE-2026-67401
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTr
48RISCO
abrir ↗GitHub PoC
CVE-2026-67401 - Draft or TODO
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTr
48RISCO
abrir ↗VulnCheck XDB
initial-access
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4
78RISCO
abrir ↗GitHub PoC
Deep-dive analysis of CVE-2026-62201: OpenClaw sandbox exec-server network policy bypass (SSRF). Root cause, vulnerable vs patched code, exploitation, detection, remediation.
OpenClaw < 2026.6.6 Network Policy Bypass via exec-server
33RISCO
abrir ↗GitHub PoC★ 18
CVE-2026-83991: Windows Cloud Files access-check bypass
Windows Cloud Files Mini Filter Driver Tampering Vulnerability
33RISCO
abrir ↗VulnCheck XDB
info-leak
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and
100RISCO
abrir ↗VulnCheck XDB
initial-access
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
63RISCO
abrir ↗VulnCheck XDB
initial-access
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISCO
abrir ↗VulnCheck XDB
initial-access
Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version i
71RISCO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC★ 2
0xCyp1337/CVE-2026-57811
WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability
48RISCO
abrir ↗GitHub PoC★ 1
Saku0512/CVE-2026-72744-poc
Nuxt before 4.5.1 Information Disclosure via Chrome DevTools
33RISCO
abrir ↗GitHub PoC
Educational penetration testing lab report demonstrating exploitation of vsftpd 2.3.4 backdoor vulnerability (CVE-2011-2523) in Metasploitable 2 using Metasploit Framework. Includes detailed documentation of reconnaissance, vulnerability analysis, configuration, verification, and exploitation phases.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISCO
abrir ↗VulnCheck XDB
initial-access
Potential authentication bypass leading to administrative access in Artifactory
98RISCO
abrir ↗GitHub PoC★ 1
SneakyNachos/CVE-2026-85046-who-put-the-silverback-guerilla-in-the-wasm
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside
71RISCO
abrir ↗GitHub PoC★ 1
SneakyNachos/CVE-2026-84118-who-labeled-the-crit-as-a-high
Use-after-free in the JavaScript: GC component
33RISCO
abrir ↗VulnCheck XDB
client-side
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside
71RISCO
abrir ↗GitHub PoC
CVE-2025-58434 - Flowise (CVE-2025-58434) unauthenticated account takeover via password-reset token disclosure
Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover
85RISCO
abrir ↗VulnCheck XDB
local
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
100RISCO
abrir ↗GitHub PoC
CVE-2026-10795 - Draft or TODO
UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc
41RISCO
abrir ↗VulnCheck XDB
initial-access
WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action
68RISCO
abrir ↗GitHub PoC
Security-hardened fork of sift 17.1.3 for CVE-2026-85625. Not affiliated with crcn/sift.js.
sift 17.1.3 Prototype Pollution Remote Code Execution via $where
48RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.