Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.149exploits catalogados
40.888CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.559Exploit-DB 24.489GitHub PoC 18.372VulnCheck XDB 10.605Nuclei 4.584Metasploit 3.540✓ só verificadosrecentespopularesrisco
88.153 exploits
GitHub PoC
boomerangBS/CVE-2026-65647-PoC
Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as r
41RISCO
abrir ↗Exploit-DB
Langflow 1.8.4 - Path Traversal to Remote Code Execution
Langflow - Path Traversal Arbitrary File Write via upload_user_file
68RISCO
abrir ↗Exploit-DB
C-MOR 6.0104 - Cross-Site Scripting (XSS)
Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to e
33RISCO
abrir ↗Exploit-DB
CubeCart 6.7.4 - Cross-Site Scripting
CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System
33RISCO
abrir ↗Exploit-DB
CubeCart 6.7.4 - Stored XSS
CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass
33RISCO
abrir ↗GitHub PoC
Read-only CLI to check whether a WordPress site is exposed to WP2Shell (CVE-2026-63030 / CVE-2026-60137)
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗GitHub PoC★ 16
Authorized Docker lab and clean PoC for validating CVE-2026-82222 RCE in GiveWP 4.16.5.1 and the 4.16.7.2 fix.
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
63RISCO
abrir ↗GitHub PoC
CVE-2026-12513 Vulnerability Advisory & PoC — Discovered by Huynh Kien Minh (MinhHK).
Shared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path Traversal
33RISCO
abrir ↗GitHub PoC★ 1
Public PoC for CVE-2026-82222
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
63RISCO
abrir ↗GitHub PoC★ 3
Social Media Infrastructure Vulnerability Research. CVE-2026-78905: OAuth token reuse and session hijacking in Facebook's Graph API.
Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitra
21RISCO
abrir ↗GitHub PoC
Balboa form Command Injection POC
Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2
41RISCO
abrir ↗GitHub PoC
Shellshock CVE-2014-6271 vulnerable CGI lab
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-80724 PoC + full write-up — Linux kernel ptp/vmclock read-only mapping becomes writable (VM_MAYWRITE). Discovered, reported & fixed by Abdifatah Suruur (suruurism)
ptp: vmclock: prevent read-only mappings from becoming writable
41RISCO
abrir ↗GitHub PoC★ 4
CBDC Infrastructure Vulnerability Research. CVE-2026-78904: Infinite mint and redemption bypass in central bank digital currency APIs.
Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitra
28RISCO
abrir ↗GitHub PoC★ 1
PoC CVE-2026-18741
Worksuite SaaS version prior to 6.0.14 Stored XSS via Asset Management Location and Description Fields
33RISCO
abrir ↗GitHub PoC
CVE-2026-76581
WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
48RISCO
abrir ↗VulnCheck XDB
initial-access
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
63RISCO
abrir ↗VulnCheck XDB
initial-access
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
63RISCO
abrir ↗VulnCheck XDB
initial-access
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload
60RISCO
abrir ↗GitHub PoC
CVE-2026-45833 ChromaDB
A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacke
48RISCO
abrir ↗VulnCheck XDB
initial-access
Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or
63RISCO
abrir ↗VulnCheck XDB
initial-access
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
98RISCO
abrir ↗GitHub PoC
🫖 Direct single-target Gitea CVE-2026-60004 RCE validation PoC
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
98RISCO
abrir ↗GitHub PoC
🫖 Contract-correlated discovery and authorized validation tool for Gitea CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
98RISCO
abrir ↗GitHub PoC★ 2
Offensive Research & Exploit Development. Vulnerability research, PoC development, and offensive tooling for financial infrastructure.
Incomplete cleanup in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromise
8RISCO
abrir ↗GitHub PoC★ 1
FastGPT Community Edition NoSQL Injection PoC (CVE-2026-79483)
FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistor
33RISCO
abrir ↗GitHub PoC
Safe passive detector for identifying WPMU DEV Dashboard versions affected by CVE-2026-76581.
WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
48RISCO
abrir ↗GitHub PoC
CitrixBleed Exploit Tool - CVE-2025-5777 & CVE-2026-8452. Unauthenticated remote memory read from Citrix NetScaler ADC & Gateway. Steal admin session tokens, extract nsroot hashes, dump secrets, and bypass MFA. Python 3 exploit with full memory parsing.
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISCO
abrir ↗GitHub PoC
Drupalgeddon2 CVE-2018-7600 vulnerable Drupal 7 lab
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.