Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.871exploits catalogados
40.961CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.571Exploit-DB 24.489GitHub PoC 18.446VulnCheck XDB 11.241Nuclei 4.584Metasploit 3.540✓ só verificadosrecentespopularesrisco
88.871 exploits
Metasploit300
Forgejo Arbitrary File Read via Org-mode Include
Gitea Org-mode file disclosure and code execution
68RISCO
abrir ↗VulnCheck XDB
initial-access
WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability
75RISCO
abrir ↗GitHub PoC
Demonstrate the unauthenticated remote code execution vulnerability in the RSFiles! Joomla component through an arbitrary file upload.
Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12
68RISCO
abrir ↗GitHub PoC
PoC exploits for CVE-2026-52824 (GHSA-jr9p-4h4j-6c58) — Kimai time-tracking default APP_SECRET authentication bypass affecting versions ≤ 2.57.0
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
63RISCO
abrir ↗GitHub PoC
KunalKhandelwal-dev/cve-2021-41773-lab
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISCO
abrir ↗GitHub PoC★ 2
Security research tool for FortiWeb CVE-2025-64446 vulnerability. Automated exploitation framework with advanced logging, real-time metrics, proxy debugging, and professional reporting. Includes retry logic, multi-threading, and configurable settings. For authorized security testing only. CVSS 9.8 Critical.
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb
100RISCO
abrir ↗GitHub PoC★ 1
DJ-Classifieds Joomla Component Unauthenticated File Upload RCE. 3-string filter bypass via PHP short tags. CVSS 10.0 | CWE-434 | com_djclassifieds < 3.11.2
Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2
48RISCO
abrir ↗GitHub PoC
CVE-2026-59726 - Draft or Todo
Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment
63RISCO
abrir ↗GitHub PoC
Security Advisory: Stored Cross-Site Scripting Via Agent Messages Leading To Session Token Theft (openclaw-dashboard)
OpenClaw Dashboard Stored XSS via lastMessage Session Field
41RISCO
abrir ↗GitHub PoC★ 30
rails/rails-forensics-CVE-2026-66066
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
75RISCO
abrir ↗GitHub PoC
the CVE-2018-4878 Adobe Flash DRM UAF exploit for educational vulnerability research
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to
93RISCO
abrir ↗GitHub PoC
shootcannon/CVE-2026-61511
vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
63RISCO
abrir ↗GitHub PoC
CVE-2026-63030 Exploit | by gr1tx
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗GitHub PoC
Hands-on exploit lab for CVE-2024-28000 — unauthenticated privilege escalation in LiteSpeed Cache (WordPress plugin, <=6.3.0.1). Spins up a vulnerable environment with Docker and includes a Go-based brute-forcer that cracks the weak mt_rand hash to create an administrator account.
WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability
75RISCO
abrir ↗GitHub PoC★ 2
A critical vulnerability affecting Fastjson versions 1.2.68 – 1.2.83.
Remote Code Execution in fastjson 1.2.68–1.2.83
48RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-43499 exploit adapter for MT6985 MediaTek Dimensity 9300 (vivo PD2241)
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISCO
abrir ↗GitHub PoC★ 9
CVE-2026-43813: CloudAttestation enforceEnvironment bypass
A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macO
41RISCO
abrir ↗GitHub PoC
manfredgabriel/cve-2021-41773-lab
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISCO
abrir ↗GitHub PoC
webshellseo8/CVE-2026-57811-Proof-of-Concept
WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability
48RISCO
abrir ↗GitHub PoC★ 16
CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE. Split-controller upload bypass. CVSS 9.8 | CWE-434 | com_rsfiles < 1.17.12
Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12
68RISCO
abrir ↗GitHub PoC
webshellseo8/CVE-2026-50522-Proof-of-Concept
Microsoft SharePoint Remote Code Execution Vulnerability
78RISCO
abrir ↗GitHub PoC★ 5
CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
98RISCO
abrir ↗GitHub PoC★ 1
Gitea Docker Image Authentication Bypass
Gitea Docker image trusts spoofable reverse-proxy headers by default
63RISCO
abrir ↗GitHub PoC
Public technical advisory and reproduction evidence for CVE-2026-52134 affecting GOOSE replay handling in libiec61850 v1.6.
An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass au
48RISCO
abrir ↗VulnCheck XDB
initial-access
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
75RISCO
abrir ↗GitHub PoC★ 4
CVE-2026-49176 WalletService LPE — standalone PoC + Cobalt Strike BOF (SYSTEM command on interactive session)
Windows WalletService Elevation of Privilege Vulnerability
41RISCO
abrir ↗VulnCheck XDB
info-leak
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.