Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.871exploits catalogados

40.961CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.571Exploit-DB 24.489GitHub PoC 18.446VulnCheck XDB 11.241Nuclei 4.584Metasploit 3.540✓ só verificadosrecentes populares risco

88.871 exploits

GitHub PoC

Laboratory validation of CVE-2026-48282 in Adobe ColdFusion RDS, covering arbitrary CFM file write, code execution as the ColdFusion service user, auditd and PCAP evidence, event timeline reconstruction, and SOC detection recommendations. Includes Polish and English reports.

CVE-2026-48282CRITICALsob ataque07 jul 2026

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

100RISCO

GitHub PoC★ 3

CVE-2026-42271 - LiteLLM AI Gateway MCP Command Injection RCE - PoC & Analysis | CVSS 8.8 | AMN SECURITY

CVE-2026-42271HIGHsob ataque07 jul 2026

LiteLLM: Authenticated command execution via MCP stdio test endpoints

100RISCO

GitHub PoC

Laboratory validation of CVE-2026-48282 in Adobe ColdFusion RDS, covering arbitrary CFM file write, code execution as the ColdFusion service user, auditd and PCAP evidence, event timeline reconstruction, and SOC detection recommendations. Includes Polish and English reports.

CVE-2026-48282CRITICALsob ataque07 jul 2026

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

100RISCO

GitHub PoC★ 3

A complete walkthrough and exploit for CVE-2019-9978 - Unauthenticated Remote Code Execution in Social Warfare WordPress plugin ≤ 3.5.2. Includes vulnerable code analysis and payload examples.

CVE-2019-9978MEDIUMsob ataque07 jul 2026

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio

100RISCO

GitHub PoC

Vtiger CRM 8.3.0 Authenticated RCE via .phar Upload

CVE-2026-23697HIGH07 jul 2026

Vtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents Module

41RISCO

GitHub PoC★ 2

CVE-2026-14762 exploit for Hotel & Tourism Reservation 1.0. Time-based blind SQL injection via /admin/rooms.php?delete. Dumps DB, tables, columns, reads files, writes webshells. Multi-threaded, proxy support, interactive shell. CVSS 7.3. Authorized & Legal testing only.

CVE-2026-14762MEDIUM07 jul 2026

code-projects Hotel and Tourism Reservation Room Management rooms.php sql injection

33RISCO

Exploit-DB

Hydra - Stack Buffer Overflow

CVE-2026-56766HIGHremotelinux07 jul 2026

Hydra - Stack Buffer Overflow in NTLM Authentication Handler

41RISCO

GitHub PoC★ 10

CVE-2026-20896 Gitea Docker X-WEBAUTH-USER auth bypass checker

CVE-2026-20896CRITICAL07 jul 2026

Gitea Docker image trusts spoofable reverse-proxy headers by default

63RISCO

VulnCheck XDB

initial-access

CVE-2026-42271HIGHsob ataque07 jul 2026

LiteLLM: Authenticated command execution via MCP stdio test endpoints

100RISCO

VulnCheck XDB

initial-access

CVE-2026-48282CRITICALsob ataque07 jul 2026

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

100RISCO

VulnCheck XDB

initial-access

CVE-2014-6271CRITICALsob ataque07 jul 2026

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RISCO

GitHub PoC

Shellshock

CVE-2014-6271CRITICALsob ataque07 jul 2026

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RISCO

GitHub PoC

PoC for CVE-2026-54350 — Budibase unauthenticated NoSQL operator injection (CVSS 10.0). Read/mass-write any document collection via a PUBLIC query.

CVE-2026-54350CRITICAL07 jul 2026

Budibase: Anonymous NoSQL operator injection via published-app query templates

48RISCO

VulnCheck XDB

initial-access

CVE-2026-20896CRITICAL07 jul 2026

Gitea Docker image trusts spoofable reverse-proxy headers by default

63RISCO

VulnCheck XDB

initial-access

CVE-2021-41773HIGHsob ataqueransomware07 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

VulnCheck XDB

initial-access

CVE-2026-48611CRITICAL07 jul 2026

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or

63RISCO

GitHub PoC★ 2

IOCs and a read-only triage checklist from a real Linux root compromise: RedTail miner, XorDDoS persistence, MoneroOcean miner, DirtyFrag LPE (CVE-2026-43284/43500). CC0.

CVE-2026-43284HIGH07 jul 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RISCO

GitHub PoC★ 1

A17-ba/CVE-2026-51119

CVE-2026-51119CRITICAL07 jul 2026

An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser co

48RISCO

GitHub PoC★ 3

CVE-2026-48908 — PoC exploit for unauthenticated RCE in SP Page Builder (Joomla) via arbitrary file upload. Multi‑threaded, case‑bypass, shell verification. For authorized security testing only.

CVE-2026-48908CRITICALsob ataque07 jul 2026

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

100RISCO

GitHub PoC

This is a Proof-of-Concept for the Blink CSS UAF vulnerability tracked as CVE-2026-6300.

CVE-2026-6300HIGH07 jul 2026

Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code insid

41RISCO

VulnCheck XDB

initial-access

CVE-2024-36401CRITICALsob ataque07 jul 2026

Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

100RISCO

GitHub PoC

whs-homework

CVE-2021-41773HIGHsob ataqueransomware07 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

GitHub PoC

NEO-SQLi — exploit Django _connector SQL Injection (CVE-2025-64459) | canal RedTeam Brasil

CVE-2025-64459CRITICAL07 jul 2026

Potential SQL injection via _connector keyword argument in QuerySet and Q objects

53RISCO

GitHub PoC★ 4

CVE-2026-53359

CVE-2026-53359HIGH07 jul 2026

KVM: x86: Fix shadow paging use-after-free due to unexpected role

41RISCO

GitHub PoC★ 6

Complete fix collection for the CVE-2026-53359 guest-to-host escape vulnerability in the KVM/x86 shadow MMU. From zero-downtime livepatch to kernel upgrade — covers every operational scenario. / KVM/x86 shadow MMU 虚拟机逃逸漏洞（CVE-2026-53359）的完整修复方案集合。从零停机热修复到内核升级，覆盖所有运维场景。

CVE-2026-53359HIGH07 jul 2026

KVM: x86: Fix shadow paging use-after-free due to unexpected role

41RISCO

GitHub PoC

CVE-2026-11405 - Draft

CVE-2026-11405CRITICAL07 jul 2026

Hidden backdoor authentication mechanism in multiple versions of Tenda firmware allows admin access to web management interface

48RISCO

GitHub PoC★ 1

Stored Cross-Site Scripting (XSS) in osTicket via Vulnerable Bootstrap Tooltip Component

CVE-2026-36214MEDIUM07 jul 2026

osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable

33RISCO

GitHub PoC

CVE-2026-53359 - Draft

CVE-2026-53359HIGH07 jul 2026

KVM: x86: Fix shadow paging use-after-free due to unexpected role

41RISCO

GitHub PoC★ 2

Linux 内核升级指南 - 修复 CVE-2026-53359

CVE-2026-53359HIGH07 jul 2026

KVM: x86: Fix shadow paging use-after-free due to unexpected role

41RISCO

Exploit-DB

Tenable Nessus 10.12.1 - SQL Injection

CVE-2026-57588LOWwebappsmultiple07 jul 2026

SQL Injection in Nessus via Malicious Scan Result File Import

28RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.