Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
87.464exploits catalogados
40.695CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4.577Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.464 exploits
GitHub PoC★ 1
Unauthenticated RCE in PHP via session.upload_progress use-after-free (CVE-2026-109618 / CVE-2026-109619)
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 3
Check whether a website is affected by PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 18
CVE-2026-98260（fs/exec.c POSIX CPU timer UAF）XRING O1 / Android 17 / 6.18.21 研究记录与 PC 一键流程（授权设备安全研究）
exec: Cleanup POSIX timers right after de_thread()
41RISCO
abrir ↗GitHub PoC★ 2
CVE-2026-98260 (exec: posix CPU timer UAF) - one-command temporary root for OnePlus 16 (PYB110) from uid 2000 shell, with KernelSU/FinaSU handover
exec: Cleanup POSIX timers right after de_thread()
41RISCO
abrir ↗VulnCheck XDB
initial-access
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra
100RISCO
abrir ↗VulnCheck XDB
info-leak
YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId
41RISCO
abrir ↗VulnCheck XDB
initial-access
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
53RISCO
abrir ↗VulnCheck XDB
info-leak
Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Trave
60RISCO
abrir ↗GitHub PoC★ 1
Target-specific Android CVE-2026-98260 research port for Xiaomi 17 (pudding)
exec: Cleanup POSIX timers right after de_thread()
41RISCO
abrir ↗VulnCheck XDB
initial-access
TVT NVMS-9000 Hard-coded API Credentials & Command Injection
48RISCO
abrir ↗VulnCheck XDB
initial-access
Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in ou
35RISCO
abrir ↗VulnCheck XDB
info-leak
An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REG
50RISCO
abrir ↗VulnCheck XDB
initial-access
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle
100RISCO
abrir ↗GitHub PoC★ 2
CVE-2026-109619 (PHP2Shell): Pre-Auth Remote Code Execution (RCE) via PHP-FPM Stale Global State Deserialization UAF. Reproducible Docker lab, interactive shell, reverse shell & WAF/IDS rules.
RCE via stale global state
100RISCO
abrir ↗GitHub PoC
A local Docker environment and proof of concept for Node2Shell (CVE-2026-111497)
Out-of-Bounds Write in Google Brotli Decoder
70RISCO
abrir ↗GitHub PoC
Safe PoC and technical analysis for CVE-2026-116000
Zylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgery
33RISCO
abrir ↗GitHub PoC
Safe PoC and technical analysis for CVE-2026-116004
onyx-dot-app Onyx PreviewTab.tsx cross site scripting
33RISCO
abrir ↗GitHub PoC★ 6
REDMI K90 Max在OS4.0.5.0.XAACNXM利用CVE-2026-98260获取ROOT权限并加载KSU模块。
exec: Cleanup POSIX timers right after de_thread()
41RISCO
abrir ↗VulnCheck XDB
initial-access
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.