Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.871exploits catalogados
40.961CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.571Exploit-DB 24.489GitHub PoC 18.446VulnCheck XDB 11.241Nuclei 4.584Metasploit 3.540✓ só verificadosrecentespopularesrisco
88.871 exploits
GitHub PoC
PoC and writeup for CVE-2026-46394: OS command injection in HAXcms Git.php (CWE-78). Authorized security research only.
HAX CMS Vulnerable to Command Injection using Git.php
41RISCO
abrir ↗GitHub PoC
Running OWASP cve-lite-cli against the pi monorepo: scan journey and key finding (vitest CVE-2026-47429).
Vitest: Arbitrary file can be read and executed when Vitest UI server is listening
48RISCO
abrir ↗GitHub PoC
Samir660x/React2Shell_CVE-2025-55182
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-41089
Windows Netlogon Remote Code Execution Vulnerability
70RISCO
abrir ↗VulnCheck XDB
initial-access
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISCO
abrir ↗GitHub PoC★ 1
Proof-of-concept demonstrating cross-user X11 session compromise in Pardus LightDM Greeter caused by the unsafe `xhost +local:` configuration, including unauthorized shell access, display access, screen capture, window enumeration, and XTEST input injection.
Improper Access Control Leading to Display Exposure in TÜBİTAK BİLGEM's Pardus LightDM Greeter
41RISCO
abrir ↗GitHub PoC
CVE-2026-45247 - Mirasvit Full Page Cache Warmer for Magento 2 Unauthenticated PHP Object Injection -> Remote Code Execution
Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
83RISCO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-23479
redis-server use-after-free in unblock client flow may allow remote code execution
41RISCO
abrir ↗GitHub PoC★ 1
I created simple react2shell CVE-2025-55182 python exploit
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-45659
Microsoft SharePoint Remote Code Execution Vulnerability
93RISCO
abrir ↗VulnCheck XDB
client-side
Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting
41RISCO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-28318
SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability
83RISCO
abrir ↗GitHub PoC
fevar54/CVE-2024-21182---Oracle-WebLogic-Server-JNDI-Injection-RCE
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t
93RISCO
abrir ↗GitHub PoC★ 1
Caderno Temático NotebookLM: análise de vulnerabilidades SQL Injection (CVE-2024-42327, CVE-2026-23921) no Zabbix, com engenharia de prompts, cadeia de ataque até RCE e miniguia de hardening
SQL injection in user.get API
70RISCO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-48595
Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects
21RISCO
abrir ↗GitHub PoC
Go Proof of Concept (PoC) exploit for Flowise CustomMCP Remote Code Execution (RCE) CVE-2025-59528
Flowise has Remote Code Execution vulnerability
85RISCO
abrir ↗GitHub PoC★ 1
Insert PHP Plugin PHP Code Injection
WordPress Insert PHP Plugin < 3.3.1 PHP Code Injection via REST API
48RISCO
abrir ↗GitHub PoC
Patched google_gax 0.4.1 for Tesla 1.18.3+ compatibility (CVE-2026-48598)
CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection
28RISCO
abrir ↗VulnCheck XDB
initial-access
Piotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload
63RISCO
abrir ↗GitHub PoC★ 1
PoC de CVE-2025-48595: desbordamiento de entero en multiples ubicaciones del Framework de Android.
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to
71RISCO
abrir ↗GitHub PoC
dotCMS Pre-auth SQL Injection
Unauthenticated SQL Injection in dotCMS Publish Audit API
63RISCO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-0257
PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
100RISCO
abrir ↗VulnCheck XDB
initial-access
Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
83RISCO
abrir ↗GitHub PoC
kennedy-aikohi/mcpjam-cve-2026-23744-validator
REC in MCPJam inspector due to HTTP Endpoint exposes
75RISCO
abrir ↗GitHub PoC
CVE-2026-45067 - Draft
Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
33RISCO
abrir ↗VulnCheck XDB
initial-access
Samba: samba: remote code execution in printing subsystem via unescaped job description
68RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.