Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.639exploits catalogados
40.918CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.560Exploit-DB 24.489GitHub PoC 18.402VulnCheck XDB 11.064Nuclei 4.584Metasploit 3.540✓ só verificadosrecentespopularesrisco
88.639 exploits
GitHub PoC
Patch: Remote code execution in SPL parsing (Splunk Enterprise)
WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability
48RISCO
abrir ↗VulnCheck XDB
initial-access
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
63RISCO
abrir ↗VulnCheck XDB
initial-access
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISCO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗VulnCheck XDB
denial-of-service
A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secu
100RISCO
abrir ↗GitHub PoC
xAL6/cve-2026-64638-banner-poc
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malici
56RISCO
abrir ↗VulnCheck XDB
initial-access
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
98RISCO
abrir ↗GitHub PoC
Patch: OGNL injection (Apache Struts)
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote
100RISCO
abrir ↗GitHub PoC
Patch: Authentication bypass (VMware vCenter)
Tenda HG7/HG9/HG10 formPPPEdit stack-based overflow
41RISCO
abrir ↗GitHub PoC
Reproducer for CVE-2026-66907 (Apache Camel camel-google-storage downloadFileName path traversal) — Camel Spring Boot + Camel Quarkus
Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result
41RISCO
abrir ↗GitHub PoC
Patch: Command injection in GlobalProtect (Palo Alto PAN-OS)
Embed Google Photos Album Easily <= 2.2.1 - Contributor+ Stored XSS via link Shortcode Attribute
33RISCO
abrir ↗GitHub PoC★ 20
CVE-2026-18963
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISCO
abrir ↗GitHub PoC★ 4
T0w0T/POC-CVE-2026-18963
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISCO
abrir ↗GitHub PoC
Reproducer for CVE-2026-66908 (Apache Camel camel-platform-http-main JWT iss/aud not validated) — standalone camel-main
Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted
41RISCO
abrir ↗GitHub PoC★ 1
PoC exploit chain for CVE-2026-15718: SpiderMonkey wasm baseline compiler array.fill missing-sync -> invalid pointer -> addrOf/fakeobj -> arbitrary R/W -> RCE
Invalid pointer in the JavaScript: WebAssembly component
33RISCO
abrir ↗GitHub PoC
chessalekin/cve-2026-9198_exploit
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
98RISCO
abrir ↗GitHub PoC
From MCPJam Inspector RCE to root — CVE-2026-23744, JupyterLab token disclosure, kernel execution, and OPSMCP privilege escalation
REC in MCPJam inspector due to HTTP Endpoint exposes
75RISCO
abrir ↗GitHub PoC
CVSS v3.1 assessment of CVE-2009-0658 (Adobe Acrobat Buffer Overflow), including Base, Temporal, and Environmental scoring and remediation recommendations.
Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitra
60RISCO
abrir ↗GitHub PoC
Professional PHPMyAdmin 5.0.0 SQL Injection (CVE-2020-5504) exploitation framework with automated database enumeration, table extraction, and data dumping capabilities. Features blind injection, proxy support, JSON output, and comprehensive error handling for authorized penetration testing and security research. Author: Sudeepa Wanigarathna
In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could
28RISCO
abrir ↗GitHub PoC
Password-Protected Category Bypass via JSON Format in JoomGallery
Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0
33RISCO
abrir ↗GitHub PoC★ 4
Reproducible lab for CVE-2026-10053 (GitLab npm package-registry path traversal -> arbitrary file write as git). Vulnerable 19.2.1 vs patched 19.2.2, deterministic oracle.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
41RISCO
abrir ↗GitHub PoC
IDOR + Stored XSS via Broken Object-Level Authorization in JoomGallery
Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0
41RISCO
abrir ↗GitHub PoC
Legendile7/CVE-2026-78122-POC
docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems
41RISCO
abrir ↗GitHub PoC
Exploiting the vsftpd 2.3.4 backdoor (CVE-2011-2523) on Metasploitable2 — a hands-on pentesting lab writeup covering recon, exploitation, and remediation.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISCO
abrir ↗GitHub PoC
Metasploit-based penetration test on an isolated Metasploitable2 lab VM — remote exploitation via DistCC (CVE-2004-2687), privilege escalation via udev netlink (CVE-2009-1185), and vsftpd 2.3.4 backdoor analysis (CVE-2011-2523), with firewall mitigation validated end-to-end.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISCO
abrir ↗GitHub PoC
CVE-2026-47630 — NVIDIA Triton Inference Server: arbitrary dlopen via TRITON_BATCH_STRATEGY_PATH
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path travers
33RISCO
abrir ↗VulnCheck XDB
info-leak
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to a
90RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.