Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.871exploits catalogados

40.961CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.571Exploit-DB 24.489GitHub PoC 18.446VulnCheck XDB 11.241Nuclei 4.584Metasploit 3.540✓ só verificadosrecentes populares risco

88.871 exploits

GitHub PoC★ 1

ExifTool arbitrary code execution via a crafted DjVu image (versions 7.44 to 12.23). PoC builds a pure DjVu payload with djvumake, so the attacker machine needs no vulnerable ExifTool.

CVE-2021-22204MEDIUMsob ataque13 jun 2026

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec

100RISCO

VulnCheck XDB

initial-access

CVE-2026-6279CRITICAL13 jun 2026

Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

63RISCO

VulnCheck XDB

remote-with-credentials

CVE-2018-9276HIGHsob ataque13 jun 2026

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administra

100RISCO

GitHub PoC★ 12

CVE-2026-25243 — Redis RESTORE zipmap double-free → remote code execution (ASLR on).

CVE-2026-25243HIGH13 jun 2026

redis-server RESTORE invalid memory access may allow remote code execution

41RISCO

GitHub PoC★ 1

CVE-2026-6279

CVE-2026-6279CRITICAL13 jun 2026

Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

63RISCO

GitHub PoC★ 1

HTTP/2 Bomb: HPACK indexed-reference amplification + flow-control stall. A high school student's full protocol analysis (LaTeX). CVE-2026-49975, CVE-2026-47774.

CVE-2026-49975HIGH13 jun 2026

Apache HTTP Server: mod_http2 denial of service

53RISCO

GitHub PoC★ 1

Hunt-Benito/glinet-beryl-ax-triple-rce-cve-2026-11450-11451-11452-unauthenticated-root-on-travel-router

CVE-2026-11450MEDIUM13 jun 2026

GL.iNet GL-MT3000 Path Normalization dlopen command injection

33RISCO

VulnCheck XDB

client-side

CVE-2021-22204MEDIUMsob ataque13 jun 2026

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec

100RISCO

VulnCheck XDB

initial-access

CVE-2026-48611CRITICAL13 jun 2026

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or

63RISCO

VulnCheck XDB

local

CVE-2021-4034HIGHsob ataqueransomware13 jun 2026

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RISCO

GitHub PoC★ 2

razureink/cve-2026-49975-http2bomb_reproduction

CVE-2026-49975HIGH13 jun 2026

Apache HTTP Server: mod_http2 denial of service

53RISCO

GitHub PoC

CVE-2025-55182 exploit script

CVE-2025-55182CRITICALsob ataqueransomware13 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

GitHub PoC

rootdirective-sec/CVE-2026-42647-Lab

CVE-2026-42647CRITICAL13 jun 2026

WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability

63RISCO

GitHub PoC★ 5

CVE-2026-20253

CVE-2026-20253CRITICALsob ataque13 jun 2026

Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

100RISCO

VulnCheck XDB

denial-of-service

CVE-2026-42647CRITICAL13 jun 2026

WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability

63RISCO

GitHub PoC★ 2

HTTP/2 Bomb (CVE-2026-49975) non-destructive vulnerability detector for Nginx / Apache httpd. Zero-dependency Python.

CVE-2026-49975HIGH13 jun 2026

Apache HTTP Server: mod_http2 denial of service

53RISCO

GitHub PoC★ 1

CVE-2026-45447

CVE-2026-45447HIGH13 jun 2026

Heap Use-After-Free in the PKCS7_verify() Function

41RISCO

GitHub PoC

A lightweight stdio-based MCP server for local file system operations — read, write, edit, search, exec for AI assistants. Specially optimized for Chatbox: bat-bypass for exec (CVE-2026-6130), b64 encoding to eliminate escaping issues, and multi-pattern regex for precise code block targeting.

CVE-2026-6130MEDIUM13 jun 2026

chatboxai chatbox Model Context Protocol Server Management System ipc-stdio-transport.ts StdioClientTransport os command injection

33RISCO

VulnCheck XDB

initial-access

CVE-2026-48907CRITICALsob ataque13 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISCO

GitHub PoC

Technical writeup and Proof of Concept (PoC) for CVE-2026-11417: OS Command Injection / Remote Code Execution (RCE) in AWS CDK's NodejsFunction.

CVE-2026-11417HIGH13 jun 2026

OS Command Injection in NodejsFunction Bundling in aws-cdk-lib

41RISCO

GitHub PoC

87achrafg-stack/CVE-2026-48907

CVE-2026-48907CRITICALsob ataque13 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISCO

GitHub PoC

CVE-2018-9276 — PRTG Network Monitor < 18.2.39 Authenticated RCE. For educational purposes and authorized penetration testing only.

CVE-2018-9276HIGHsob ataque13 jun 2026

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administra

100RISCO

GitHub PoC

CyruxSec/CVE-2025-4524

CVE-2025-4524CRITICAL13 jun 2026

Madara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File Inclusion

68RISCO

GitHub PoC

CyruxSec/CVE-2026-4524

CVE-2026-4524MEDIUM13 jun 2026

Authentication Bypass Using an Alternate Path or Channel in GitLab

33RISCO

VulnCheck XDB

remote-with-credentials

CVE-2026-25243HIGH13 jun 2026

redis-server RESTORE invalid memory access may allow remote code execution

41RISCO

GitHub PoC

JupyterHub XSRF bypass via cross-origin form POST (Sec-Fetch-Mode: no-cors) — CWE-352

CVE-2026-40864MEDIUM13 jun 2026

JupyterHub: Cross-origin form POSTs bypass XSRF

33RISCO

GitHub PoC

PoC educacional do CVE-2021-4034, o PwnKit, LPE via pkexec do polkit. Uso autorizado apenas.

CVE-2021-4034HIGHsob ataqueransomware13 jun 2026

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RISCO

GitHub PoC★ 4

CVE-2026-35273

CVE-2026-35273CRITICALsob ataqueransomware12 jun 2026

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mana

100RISCO

GitHub PoC

CVE-2026-49777 - ShapedPlugin Product Slider Pro for WooCommerce Backdoor RCE

CVE-2026-49777CRITICAL12 jun 2026

WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability

63RISCO

GitHub PoC★ 2

CVE-2026-35273

CVE-2026-35273CRITICALsob ataqueransomware12 jun 2026

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mana

100RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.