Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.871exploits catalogados
40.961CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.571Exploit-DB 24.489GitHub PoC 18.446VulnCheck XDB 11.241Nuclei 4.584Metasploit 3.540✓ só verificadosrecentespopularesrisco
88.871 exploits
VulnCheck XDB
initial-access
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISCO
abrir ↗VulnCheck XDB
initial-access
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISCO
abrir ↗VulnCheck XDB
initial-access
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISCO
abrir ↗GitHub PoC★ 1
PoC for CVE-2023-44487 ( HTTP/2 Rapid Reset Attack ) Concept
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many
93RISCO
abrir ↗GitHub PoC★ 2
wp2shell - WordPress RCE & PoC (CVE-2026-63030 + CVE-2026-60137)
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗GitHub PoC★ 4
Abdal CVE-2026-63030 is a professional WordPress vulnerability scanner designed to detect exposure to CVE-2026-63030 through version analysis and REST API security checks. Developed by Ebrahim Shafiei (EbraSha) for cybersecurity research, penetration testing, and WordPress security assessment.
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗GitHub PoC
Hunt-Benito/zephyr-lwm2m-firmware-update-oob-read-cve-2026-10672-truncated-package-uri
Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)
41RISCO
abrir ↗GitHub PoC
akash-osmsec/CVE-2026-44262-
Scramble: Remote code execution via evaluation of user-controlled input in validation rules
63RISCO
abrir ↗GitHub PoC
vivo X Fold6 (V2545A) GhostLock CVE-2026-43499 临时root/永久解锁研究
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISCO
abrir ↗GitHub PoC★ 5
Pre-auth RCE in WordPress Core via REST API batch route confusion + WP_Query SQLi (CVE-2026-63030 / CVE-2026-60137). Detection PoC.
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗GitHub PoC
Non-intrusive detection scanner for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030 + CVE-2026-60137). Detection-only, no exploitation.
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗GitHub PoC★ 1
CVE-2021-3129: Laravel Debug Mode RCE - Complete exploitation lab with Python exploit, Docker container, and security analysis guide.
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra
100RISCO
abrir ↗GitHub PoC★ 1
PoC for CVE-2026-46420, command injection in shivammathur/setup-php via repository-controlled PHP version resolution.
setup-php: Command Injection in Repository-Derived PHP Version Resolution
33RISCO
abrir ↗GitHub PoC★ 6
wp2shell - WordPress CVE-2026-63030 Exploit & Scanner
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗GitHub PoC
iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15
98RISCO
abrir ↗GitHub PoC★ 4
Blackbox, non-intrusive detector for wp2shell (WordPress core pre-auth RCE, CVE-2026-63030 / CVE-2026-60137). Detection only.
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗GitHub PoC★ 10
wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on WP 6.9.0–6.9.4 / 7.0.0–7.0.1.
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISCO
abrir ↗GitHub PoC★ 1
Automated exploit chain for CVE-2026-63030 / CVE-2026-60137 — unauthenticated blind SQLi via WordPress REST batch route-confusion. Dumps user hashes, cracks credentials, deploys webshell. Supports single target and bulk site lists. For authorized security testing only.
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗GitHub PoC★ 5
CVE-2026-15409/15410 SonicWall SMA1000 multi-exploit Framework - SSRF→Erlang RPC→RCE→root privesc. Features: --detect safe check, --exec, --read-file, --privesc, --rpc, interactive shell, batch threading, file write, ws-url override, pipe support. KEV listed CVSS 10.0 actively exploited. Authorized testing only. Use Ethically, Stay Legal.
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A
93RISCO
abrir ↗VulnCheck XDB
info-leak
[20230201] - Core - Improper access check in webservice endpoints
100RISCO
abrir ↗GitHub PoC
fancyzll/CVE-2026-43499_OPPO-MT6835
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISCO
abrir ↗GitHub PoC
Reproducer for CVE-2026-47323: Apache Camel CXF/Knative HeaderFilterStrategy missing inbound filtering, enabling Camel control-header injection (RCE via camel-exec) through CXF-RS/CXF-SOAP/Knative endpoints (fixed in 4.14.6/4.18.2/4.19.0)
Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering
53RISCO
abrir ↗Metasploit600
WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISCO
abrir ↗Metasploit300
WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗Metasploit600
WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗GitHub PoC
CVE-2026-38526 Exploit | by infrar3d
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a
48RISCO
abrir ↗Metasploit600
Langflow AI auto_login RCE
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
98RISCO
abrir ↗Metasploit600
Langflow AI Public Flow Build Unauth RCE
Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows
63RISCO
abrir ↗Metasploit300
WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISCO
abrir ↗GitHub PoC★ 10
HIKRAVEN - Advanced Hikvision Security Assessment Platform for professional penetration testing. Detects 12+ CVEs including CVE-2021-36260 (CRITICAL), tests default credentials, performs network discovery, and generates professional security reports. For authorized security testing only! 🛡️🔒
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.