Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
71.062exploits catalogados
31.617CVEs com exploração pública
0testados em laboratório
TodosExploit-DB 22.467Referência 19.791GitHub PoC 13.086VulnCheck XDB 8.069Nuclei 4.187Metasploit 3.462✓ só verificadosrecentespopularesrisco
13.086 exploits
GitHub PoC
VE-2025-48595 es una vulnerabilidad de **desbordamiento de entero (integer overflow)** en múltiples ubicaciones del Framework de Android.
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to
71RISCO
abrir ↗GitHub PoC
rootdirective-sec/CVE-2025-11262-Lab
Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting
41RISCO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-0257
PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
100RISCO
abrir ↗GitHub PoC★ 1
Insert PHP Plugin PHP Code Injection
WordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST API
48RISCO
abrir ↗GitHub PoC
CVE-2026-42271 - Draft
LiteLLM: Authenticated command execution via MCP stdio test endpoints
100RISCO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-41089
Windows Netlogon Remote Code Execution Vulnerability
70RISCO
abrir ↗GitHub PoC
dotCMS Pre-auth SQL Injection
Unauthenticated SQL Injection in dotCMS Publish Audit API
63RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-48907: Unauthenticated RCE in JCE (Proof Of Concept)
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISCO
abrir ↗GitHub PoC
v3s9er/CVE-2026-52885
Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memory
41RISCO
abrir ↗GitHub PoC
CVE-2026-45247 - Mirasvit Full Page Cache Warmer for Magento 2 Unauthenticated PHP Object Injection -> Remote Code Execution
Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
83RISCO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-23479
redis-server use-after-free in unblock client flow may allow remote code execution
41RISCO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-35616
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated atta
100RISCO
abrir ↗GitHub PoC
CVE-2024-52011 - Draft
launch-editor vulnerable to command injection via the crafted request on Windows
41RISCO
abrir ↗GitHub PoC★ 1
Account takeover full PoC for CVE-2026-27886 in Strapi CMS
Strapi may leak sensitive data via relational filtering due to lack of query sanitization
48RISCO
abrir ↗GitHub PoC★ 1
Mitigation scripts for CVE-2026-50751
User Authentication Bypass in VPN Remote Access and Mobile Access
100RISCO
abrir ↗GitHub PoC
Exploitability PoC for CVE-2026-43512 (Apache Tomcat Digest Authentication Bypass)
Apache Tomcat: Digest authenticator will authenticate any unknown user
48RISCO
abrir ↗GitHub PoC
willygailo/WG-CVE-2026-1555-Linux
WebStack <= 1.2024 - Unauthenticated Arbitrary File Upload
48RISCO
abrir ↗GitHub PoC
YellowKey | BitLocker Bypass CVE-2026-45585 | Detect & Fix Automatically via Microsoft Intune
Windows BitLocker Security Feature Bypass Vulnerability
33RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-50751
User Authentication Bypass in VPN Remote Access and Mobile Access
100RISCO
abrir ↗GitHub PoC★ 2
Disclosed on June 3, 2026, the "HTTP/2 Bomb" is an unauthenticated remote DoS that combines an HPACK compression bomb with a Slowloris-style hold to exhaust server memory. It affects default HTTP/2 configurations of **nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora**.
Apache HTTP Server: mod_http2 denial of service
46RISCO
abrir ↗GitHub PoC★ 1
A PoC exploit for CVE-2026-24061 - GNU InetUtils telnetd Argument Injection Authentication Bypass
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISCO
abrir ↗GitHub PoC
GNU-InetUtils-telnetd-Authentication-Bypass-Vulnerability
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISCO
abrir ↗GitHub PoC
rootdirective-sec/CVE-2026-7465-Lab
Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes
41RISCO
abrir ↗GitHub PoC
Based on the original version:https://github.com/vulhub/vulhub/blob/master/erlang/CVE-2025-32433/exploit.py Replace Unicode checkmark with ASCII character for Windows compatibility
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISCO
abrir ↗GitHub PoC★ 1
smb spooler to RCE
Samba: samba: remote code execution in printing subsystem via unescaped job description
68RISCO
abrir ↗GitHub PoC
Python tool for analyzing CVE-2018-16763 in FUEL CMS with cleaner response parsing and interactive vulnerability checking.
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca
60RISCO
abrir ↗GitHub PoC
Unauthenticated SQL Injection to Remote Code Execution in FreePBX — CVE-2025-57819
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.