Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
88.056 exploits
GitHub PoC
Linux Kernel Exploits -> CVE-2004-0077 + CVE-2004-1235 + caps_to_root
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not prop
23RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-81780 — Hash Form RCE
WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability
48RISCO
abrir ↗GitHub PoC
CVE-2026-39987 Proof of Concept
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISCO
abrir ↗GitHub PoC
Security-research lab: CVE-2026-47172 (workflow_run pwn request in deploy.yaml) — flattened snapshot of duck-organization/questbot at 1903b2f
Quest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_run` deployment.
48RISCO
abrir ↗GitHub PoC★ 3
CVE-2026-82329 — JFrog Artifactory Auth Bypass
Potential authentication bypass leading to administrative access in Artifactory
98RISCO
abrir ↗GitHub PoC★ 15
CVE-2026-67276 MikroTik RouterOS SSH Authentication Bypass Exploit
SSH user impersonation possible in Mikrotik RouterOS
48RISCO
abrir ↗GitHub PoC
katranSefa/CVE-2026-19949
All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution
41RISCO
abrir ↗GitHub PoC
0xCyp1337/CVE-2026-82222-MassExploit
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
63RISCO
abrir ↗GitHub PoC
LangGrinch - CVE-2025-68664 demo
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
60RISCO
abrir ↗GitHub PoC
Advisory: Cute Editor 6.4 reflected XSS via 'Theme' parameter in colorpicker_more.aspx
Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme G
33RISCO
abrir ↗GitHub PoC
CVE-2021-44228 Log4Shell reproduced end to end: exploitation through remediation
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
abrir ↗GitHub PoC
A mock app for the GitLab CVE-2023-7028, which allow multile email adresses when ordering a password reset.
Weak Password Recovery Mechanism for Forgotten Password in GitLab
100RISCO
abrir ↗GitHub PoC
CVE-2025-57819 - FreePBX 16 Endpoint Manager unauthenticated SQL injection to RCE (PoC)
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RISCO
abrir ↗VulnCheck XDB
initial-access
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISCO
abrir ↗GitHub PoC
0xCyp1337/CVE-2026-44402
Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi
48RISCO
abrir ↗GitHub PoC★ 121
**CVE-2026-18963** — unauthenticated Keycloak account takeover via the reset-credentials flow.
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISCO
abrir ↗VulnCheck XDB
initial-access
Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
63RISCO
abrir ↗VulnCheck XDB
info-leak
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
98RISCO
abrir ↗GitHub PoC
este laboratorio puede estar bien o mal preguntale a la IA estoy probando pero debe funcionar hahahah
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
98RISCO
abrir ↗GitHub PoC★ 105
CVE-2026-67276 RouterOS SSH public-key authentication bypass lab PoC
SSH user impersonation possible in Mikrotik RouterOS
48RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-67276 - Draft or TODO
SSH user impersonation possible in Mikrotik RouterOS
48RISCO
abrir ↗VulnCheck XDB
initial-access
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
63RISCO
abrir ↗VulnCheck XDB
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
abrir ↗VulnCheck XDB
info-leak
GLPI allows unauthenticated SQL injection through the inventory endpoint
78RISCO
abrir ↗VulnCheck XDB
initial-access
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISCO
abrir ↗VulnCheck XDB
initial-access
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RISCO
abrir ↗GitHub PoC
A PoC and automated version detection/exploit tool for JetBrains TeamCity Authentication Bypass & RCE (CVE-2023-42793).
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.