Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
89.013exploits catalogados
41.057CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.648Exploit-DB 24.490GitHub PoC 18.462VulnCheck XDB 11.272Nuclei 4.601Metasploit 3.540✓ só verificadosrecentespopularesrisco
89.013 exploits
Exploit-DB
WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection
Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection
41RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-48866 — Gravity Forms <= 2.10.0.1 Arbitrary File Deletion via Path Traversal (CVSS 9.6)
WordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerability
48RISCO
abrir ↗VulnCheck XDB
initial-access
Samba: samba: remote code execution in printing subsystem via unescaped job description
68RISCO
abrir ↗GitHub PoC
t1ckprivate/CVE-2026-31431-Copy-Fail
crypto: algif_aead - Revert to operating out-of-place
100RISCO
abrir ↗GitHub PoC★ 1
Modern Events Calendar Lite <= 7.33.0 — Unauthenticated SQL Injection
Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more
41RISCO
abrir ↗GitHub PoC
ARMember Premium <= 7.3.1 Full Admin Account Takeover
ARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
48RISCO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC
yurahshell/CVE-2025-55182
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC
seguridadentrerios/CVE-2026-33829
Windows Snipping Tool Spoofing Vulnerability
33RISCO
abrir ↗VulnCheck XDB
initial-access
Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field
75RISCO
abrir ↗VulnCheck XDB
denial-of-service
WordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerability
48RISCO
abrir ↗GitHub PoC
Exploit for Copy-Fail Vulnerability - Python3 Version
crypto: algif_aead - Revert to operating out-of-place
100RISCO
abrir ↗GitHub PoC
Technical writeup and penetration testing report for CVE-2010-2075, demonstrating UnrealIRCd backdoor exploitation and remediation.
UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally
60RISCO
abrir ↗Metasploit600
Joomla Content Editor Unauthenticated File Upload RCE
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISCO
abrir ↗Metasploit300
4gaBoards Mass User Information Disclosure (CVE-2026-53959)
4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated user
48RISCO
abrir ↗GitHub PoC
yurahshell/CVE-2025-49132
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISCO
abrir ↗GitHub PoC
Dependency-free interactive Python exploit for the vsftpd 2.3.4 backdoor (CVE-2011-2523).
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISCO
abrir ↗GitHub PoC
CVE-2026-45247 - Draft
Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
83RISCO
abrir ↗VulnCheck XDB
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
abrir ↗VulnCheck XDB
info-leak
Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code
41RISCO
abrir ↗GitHub PoC
Dhananjayasj/CVE-2024-1698-NotificationX-WordPress-Plugin-SQL-Injection-to-Admin-Credential-Extraction
NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection
85RISCO
abrir ↗VulnCheck XDB
info-leak
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive informatio
60RISCO
abrir ↗GitHub PoC
CVE-2026-50142 — Heap allocation vulnerability in libheif HEIF sequence parser
libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)
41RISCO
abrir ↗GitHub PoC
rootdirective-sec/CVE-2026-34234-Lab
CtrlPanel: Unauthenticated RCE using installer script
63RISCO
abrir ↗GitHub PoC
Improved Metasploit module for CVE-2013-6117 (Dahua DVR authentication bypass)
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive informatio
60RISCO
abrir ↗GitHub PoC
CVE-2026-35904 / CVE-2026-35905 / CVE-2026-35906 — Unauth RCE, Hardcoded Root Creds & Telnet Enable in T3 Technology CPE
Incorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, an
48RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.