Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.871exploits catalogados

40.961CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.571Exploit-DB 24.489GitHub PoC 18.446VulnCheck XDB 11.241Nuclei 4.584Metasploit 3.540✓ só verificadosrecentes populares risco

88.871 exploits

VulnCheck XDB

remote-with-credentials

CVE-2026-7465HIGH17 jun 2026

Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes

41RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-48907CRITICALsob ataque17 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-49060CRITICAL17 jun 2026

WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability

63RISCO

abrir ↗

GitHub PoC

mandeepsohal/CVE-2025-66391

CVE-2025-66391HIGH17 jun 2026

In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o

41RISCO

abrir ↗

GitHub PoC

Log4Shell (CVE-2021-44228) 보안 실습 환경 - Log4j 2.14.1 취약 로그 수집 서버

CVE-2021-44228CRITICALsob ataqueransomware17 jun 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

abrir ↗

GitHub PoC

d4ngkh04w/CVE-2020-7961

CVE-2020-7961CRITICALsob ataque17 jun 2026

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c

100RISCO

abrir ↗

GitHub PoC★ 144

PACKET_EDIT_MEME.c (aka CVE-2026-46331): yet another page cache poisoning nightmare

CVE-2026-46331HIGH17 jun 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RISCO

abrir ↗

GitHub PoC

akpmarcelin/CVE-2026-24061-lab

CVE-2026-24061CRITICALsob ataque17 jun 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISCO

abrir ↗

GitHub PoC

The project documents the completion and analysis of the Fragnesia (CVE-2026-46300) TryHackME lab, which demonstrates a Linux kernel page -cache corruption vulnerability capable of achieving local privilege escalation through modification of cached file pages without altering files on disk.

CVE-2026-46300HIGHsob ataque17 jun 2026

net: skbuff: preserve shared-frag marker during coalescing

91RISCO

abrir ↗

GitHub PoC

CVE-2026-49105 WP Zendesk PHP Object Injection Exploit

CVE-2026-49105CRITICAL17 jun 2026

WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability

48RISCO

abrir ↗

GitHub PoC

87achrafg-stack/CVE-2026-49083

CVE-2026-49083HIGH17 jun 2026

WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability

41RISCO

abrir ↗

GitHub PoC

CVE-2026-8206 Kirki Plugin Unauthenticated Account Takeover Exploit

CVE-2026-8206CRITICAL17 jun 2026

Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'

48RISCO

abrir ↗

GitHub PoC

rootdirective-sec/CVE-2026-49060-Lab

CVE-2026-49060CRITICAL17 jun 2026

WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability

63RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2021-34427—17 jun 2026

In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessibl

50RISCO

abrir ↗

GitHub PoC

CVE-2026-49083 LatePoint Calendar Booking Plugin Privilege Escalation Exploit

CVE-2026-49083HIGH17 jun 2026

WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability

41RISCO

abrir ↗

GitHub PoC

CVE-2026-49085 WP Insightly PHP Object Injection Exploit

CVE-2026-49085CRITICAL17 jun 2026

WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability

48RISCO

abrir ↗

GitHub PoC

Write-ups from completed TryHackMe rooms — Linux privilege escalation, sudo buffer overflow (CVE-2019-18634), and OWASP Top 10 (2025).

CVE-2019-18634—17 jun 2026

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the

28RISCO

abrir ↗

GitHub PoC

This project documents the completion and analysis of the Fragnesia (CVE-2026-46300) TryHackMe lab, which demonstrates a Linux kernel page-cache corruption vulnerability capable of achieving local priviledge escalation through modification of cached file pages without altering files on disk.

CVE-2026-46300HIGHsob ataque17 jun 2026

net: skbuff: preserve shared-frag marker during coalescing

91RISCO

abrir ↗

GitHub PoC

CVE-2026-42758 WebinarIgnition Exploit

CVE-2026-42758CRITICAL17 jun 2026

WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability

48RISCO

abrir ↗

GitHub PoC★ 27

CVE-2026-36425 OPSWAT AppRemover (ardrv.sys) improper access control advisory

CVE-2026-36425MEDIUM17 jun 2026

An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user

33RISCO

abrir ↗

GitHub PoC

CVE-2026-48907 is a critical improper access control vulnerability in the JCE editor extension for Joomla. It allows unauthenticated attackers to create new editor profiles, which can ultimately lead to arbitrary PHP file upload and remote code execution on affected systems

CVE-2026-48907CRITICALsob ataque17 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISCO

abrir ↗

VulnCheck XDB

local

CVE-2026-46331HIGH17 jun 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RISCO

abrir ↗

GitHub PoC★ 7

Manage and recover BitLocker encrypted drives with this tool for Windows 11 recovery key management and educational study of CVE-2026-45585.

CVE-2026-45585MEDIUM16 jun 2026

Windows BitLocker Security Feature Bypass Vulnerability

33RISCO

abrir ↗

GitHub PoC

0xdak/CVE-2026-44881_exploit

CVE-2026-44881HIGH16 jun 2026

Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Update

41RISCO

abrir ↗

GitHub PoC

Resellnom/litespeed-cpanel-cve-2026-54420-fix

CVE-2026-54420HIGHsob ataque16 jun 2026

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provide

71RISCO

abrir ↗

GitHub PoC★ 2

mahfuzreham/litespeed-cpanel-cve-2026-54420-fix

CVE-2026-54420HIGHsob ataque16 jun 2026

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provide

71RISCO

abrir ↗

GitHub PoC

CVE-2026-50751 Mass Scanner

CVE-2026-50751CRITICALsob ataqueransomware16 jun 2026

User Authentication Bypass in VPN Remote Access and Mobile Access

100RISCO

abrir ↗

GitHub PoC★ 1

Mass Scanner For Drupal Exploit CVE-2026-9082

CVE-2026-9082CRITICALsob ataque16 jun 2026

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

100RISCO

abrir ↗

GitHub PoC★ 1

CVE-2026-54420

CVE-2026-54420HIGHsob ataque16 jun 2026

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provide

71RISCO

abrir ↗

VulnCheck XDB

info-leak

CVE-2024-23897CRITICALsob ataqueransomware16 jun 2026

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.