Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.871exploits catalogados

40.961CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.571Exploit-DB 24.489GitHub PoC 18.446VulnCheck XDB 11.241Nuclei 4.584Metasploit 3.540✓ só verificadosrecentes populares risco

88.871 exploits

VulnCheck XDB

initial-access

CVE-2026-1492CRITICAL06 jun 2026

User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration

68RISCO

abrir ↗

GitHub PoC★ 19

0xEhab/FreePBX-CVE-2025-57819-RCE

CVE-2025-57819CRITICALsob ataque06 jun 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-23744CRITICAL06 jun 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2025-57819CRITICALsob ataque06 jun 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-24061CRITICALsob ataque06 jun 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISCO

abrir ↗

GitHub PoC★ 8

CVE-2026-24061 - GNU inetutils-telnetd Auth Bypass Exploit - Full Control with CRLF injection via NEW_ENVIRON leads to auth bypass & instant root shell. Single/Mass exploitation, multi-threading, custom port/user, pipe mode, session keep-alive, colored output, retries, timeout support. Python & Bash versions. Critical CVSS 9.8.

CVE-2026-24061CRITICALsob ataque06 jun 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISCO

abrir ↗

GitHub PoC

Proof-of-concept exploit for CVE-2026-24849, an authenticated path-traversal / arbitrary file read in OpenEMR's Fax/SMS (EtherFax) module. Any authenticated user regardless of privilege level can read arbitrary files from the server filesystem as the web-server user (database credentials, patient documents/PHI, /etc/passwd, …

CVE-2026-24849CRITICAL06 jun 2026

OpenEMR Arbitrary File Read Vulnerability

48RISCO

abrir ↗

GitHub PoC

Reproduction and patch verification of CVE-2021-3129 (Laravel Ignition RCE) in Docker. University project, Data Privacy and Security, LUISS.

CVE-2021-3129CRITICALsob ataqueransomware06 jun 2026

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra

100RISCO

abrir ↗

GitHub PoC★ 1

horrister/moveit-transfer-cve-2023-34362

CVE-2023-34362CRITICALsob ataqueransomware06 jun 2026

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.

100RISCO

abrir ↗

GitHub PoC★ 7

CVE-2025-57819 -> rce

CVE-2025-57819CRITICALsob ataque06 jun 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-41940CRITICALsob ataqueransomware06 jun 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RISCO

abrir ↗

VulnCheck XDB

remote-with-credentials

CVE-2026-34197HIGHsob ataque06 jun 2026

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

100RISCO

abrir ↗

GitHub PoC

CVE-2023-46604-RCE exploit with Linux reverse shell payload

CVE-2023-46604CRITICALsob ataqueransomware06 jun 2026

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-3844CRITICAL06 jun 2026

Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote

68RISCO

abrir ↗

GitHub PoC

Controlled NGINX HTTP/2 frame injection lab for CVE-2026-42926 patch validation and defensive research

CVE-2026-42926MEDIUM06 jun 2026

NGINX ngx_http_proxy_v2_module vulnerability

33RISCO

abrir ↗

GitHub PoC

Dhananjayasj/CVE-2026-3844-Breeze-Cache-WordPress-Plugin-Remote-Code-Execution

CVE-2026-3844CRITICAL06 jun 2026

Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote

68RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2025-57819CRITICALsob ataque06 jun 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISCO

abrir ↗

GitHub PoC

TechWithOrgito/CVE-2025-55182-Researching-process

CVE-2025-55182CRITICALsob ataqueransomware06 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

GitHub PoC

HTTP/2 attack simulation & defense lab - Slowloris, Rapid Reset (CVE-2023-44487), HPACK Bomb attacks with 5 layered defenses. Built in pure Python with raw sockets and h2 library.

CVE-2023-44487HIGHsob ataque06 jun 2026

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many

93RISCO

abrir ↗

GitHub PoC

CVE-2026-20245 - Cisco SD-WAN - Draft

CVE-2026-20245HIGHsob ataque06 jun 2026

Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability

76RISCO

abrir ↗

GitHub PoC

t1ckprivate/CVE-2022-0847-Dirty-Pipe

CVE-2022-0847HIGHsob ataque06 jun 2026

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2023-46604CRITICALsob ataqueransomware06 jun 2026

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

100RISCO

abrir ↗

GitHub PoC★ 1

Hippoo Mobile App for WooCommerce <= 1.9.4 - Unauthenticated Authentication Bypass to Administrator Account Takeover

CVE-2026-10580CRITICAL06 jun 2026

Hippoo Mobile App for WooCommerce <= 1.9.4 - Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API

63RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2014-6271CRITICALsob ataque06 jun 2026

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RISCO

abrir ↗

GitHub PoC

t1ckprivate/CVE-2026-43284-Dirty-Frag

CVE-2026-43284HIGH05 jun 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RISCO

abrir ↗

GitHub PoC

react CVE-2025-55182

CVE-2025-55182CRITICALsob ataqueransomware05 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

GitHub PoC★ 1

CVE-2026-20230 - Cisco Unified CM

CVE-2026-20230HIGHsob ataque05 jun 2026

Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability

93RISCO

abrir ↗

GitHub PoC

ARMember Premium <= 7.3.1 Full Admin Account Takeover

CVE-2026-5076CRITICAL05 jun 2026

ARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation

48RISCO

abrir ↗

GitHub PoC★ 66

Safely detect whether a UniFi OS Server is vulnerable to CVE-2026-34908

CVE-2026-34908CRITICALsob ataque05 jun 2026

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS de

100RISCO

abrir ↗

GitHub PoC★ 21

TheCyberGeek/CVE-2026-4480-PoC

CVE-2026-4480CRITICAL05 jun 2026

Samba: samba: remote code execution in printing subsystem via unescaped job description

68RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.