Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.386exploits catalogados

36.533CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.466Referência 23.104GitHub PoC 15.075VulnCheck XDB 8.883Nuclei 4.365Metasploit 3.493✓ só verificadosrecentes populares risco

14.991 exploits

GitHub PoC★ 1

React2Shell is a proof-of-concept exploit for CVE-2025-55182 affecting vulnerable React Server Components (RSC) implementations in Next.js

CVE-2025-55182CRITICALsob ataqueransomware24 jul 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

GitHub PoC

WordPress Core Pre-Auth RCE via REST Batch Route Confusion + SQLi (CVE-2026-63030 + CVE-2026-60137)

CVE-2026-63030CRITICALsob ataque24 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISCO

abrir ↗

GitHub PoC

kxom9ks/CVE-2024-27198-TeamCity

CVE-2024-27198CRITICALsob ataqueransomware24 jul 2026

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

100RISCO

abrir ↗

GitHub PoC

Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation

CVE-2015-1328—24 jul 2026

The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does no

50RISCO

abrir ↗

GitHub PoC

manfredgabriel/cve-2021-43798-lab

CVE-2021-43798HIGHsob ataque24 jul 2026

Grafana path traversal

100RISCO

abrir ↗

GitHub PoC★ 1

CVE-2026-41940

CVE-2026-41940CRITICALsob ataqueransomware24 jul 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RISCO

abrir ↗

GitHub PoC

ange-primiterra/CVE-2026-47761

CVE-2026-47761HIGH24 jul 2026

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

41RISCO

abrir ↗

GitHub PoC★ 1

Discuz! X5.0 Authentication Bypass Exploit Framework (CVE-2026-49952) - Critical vulnerability allowing unauthenticated database backup access via UC_KEY encryption oracle token reuse. CVSS 9.1. Full-featured tool with version detection, multi-payload attacks, interactive shell, and automated exploitation. Authorized testing only.

CVE-2026-49952CRITICAL24 jul 2026

Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle

63RISCO

abrir ↗

GitHub PoC★ 4

👾 CVE-2026-60206 - Oracle WebLogic SAML Auth Bypass Exploit Framework ⚡Bash & Python versions. Features: --detect safe check, --exploit combo/unsigned/xsw/nameid/all, --shodan integration, --tor support, mass scanning, JSON/CSV/JSONL output, cookie validation. 🛡️ CVSS 9.9 Critical - Use Ethically, Stay Legal. 🔒

CVE-2026-60206CRITICAL24 jul 2026

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t

48RISCO

abrir ↗

GitHub PoC

Security Advisory: Negative Chunk-Size Parsing Causes Memory Corruption in facil.io

CVE-2026-66731HIGH24 jul 2026

facil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS

41RISCO

abrir ↗

GitHub PoC

Reproduction of cve-2024-23897-jenkins_lfi_reproduction

CVE-2024-23897CRITICALsob ataqueransomware24 jul 2026

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RISCO

abrir ↗

GitHub PoC

risorse di ricerca per cve-2026-7228

CVE-2026-7228MEDIUM24 jul 2026

SourceCodester Pizzafy Ecommerce System ajax.php get_cart_count sql injection

33RISCO

abrir ↗

GitHub PoC

Reproduction of cve-2024-3400-panos_rce_reproduction

CVE-2024-3400CRITICALsob ataqueransomware24 jul 2026

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

100RISCO

abrir ↗

GitHub PoC

Giangdurian/CVE-2026-63030-CVE-2026-60137

CVE-2026-63030CRITICALsob ataque24 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISCO

abrir ↗

GitHub PoC

Security Advisory: Camaleon CMS - Authenticated RCE via `select_eval` Custom Field

CVE-2026-66748HIGH24 jul 2026

Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field

41RISCO

abrir ↗

GitHub PoC

kxom9ks/CVE-2024-27198

CVE-2024-27198CRITICALsob ataqueransomware24 jul 2026

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

100RISCO

abrir ↗

GitHub PoC

Proof of Concept for CVE-2026-9198 - IBM Langflow Unauthenticated RCE via Auto-Login Bypass

CVE-2026-9198CRITICALsob ataque24 jul 2026

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

100RISCO

abrir ↗

GitHub PoC

Lite-os15/Lab-001-Gitea-CVE-2026-20896-

CVE-2026-20896CRITICAL24 jul 2026

Gitea Docker image trusts spoofable reverse-proxy headers by default

63RISCO

abrir ↗

GitHub PoC★ 1

PoC for CVE-2026-65650 - Elgg avatar upload DoS

CVE-2026-65650MEDIUM24 jul 2026

Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.

33RISCO

abrir ↗

GitHub PoC

is an advanced security research framework designed to model, analyze, and demonstrate Local Privilege Escalation (LPE) mechanics associated with kernel-level race conditions and filesystem structure vulnerabilities (CVE-2026-64600 / RefluXFS)

CVE-2026-64600HIGH24 jul 2026

xfs: resample the data fork mapping after cycling ILOCK

41RISCO

abrir ↗

GitHub PoC★ 1

CVE-2021-44228 Log4Shell - Apache Log4j2 JNDI Injection RCE

CVE-2021-44228CRITICALsob ataqueransomware24 jul 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

abrir ↗

GitHub PoC

Pedit COW – Linux Kernel Local Privilege Escalation (CVE-2026-46331)

CVE-2026-46331HIGH24 jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RISCO

abrir ↗

GitHub PoC★ 2

CVE-2026-60206

CVE-2026-60206CRITICAL24 jul 2026

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t

48RISCO

abrir ↗

GitHub PoC★ 1

IBM Langflow Unauthenticated RCE via Auto-Login Bypass

CVE-2026-9198CRITICALsob ataque24 jul 2026

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

100RISCO

abrir ↗

GitHub PoC

Reproduction of cve-2025-0282-ivanti_rce_reproduction

CVE-2025-0282CRITICALsob ataqueransomware24 jul 2026

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7

100RISCO

abrir ↗

GitHub PoC★ 1

最原始的

CVE-2026-43499HIGH24 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

abrir ↗

GitHub PoC

Security analysis and report of CVE-2024-6387 OpenSSH vulnerability, including vulnerability details, CVSS evaluation, and mitigation recommendations.

CVE-2024-6387HIGH23 jul 2026

Openssh: regresshion - race condition in ssh allows rce/dos

63RISCO

abrir ↗

GitHub PoC★ 1

CVE-2021-41773 Apache

CVE-2021-41773HIGHsob ataqueransomware23 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

abrir ↗

GitHub PoC

Initialized & connected PostgreSQL to Metasploit. Reconnoitered 10.1.16.0/24 with Nmap and imported results. Enumerated hosts/services using SYN, SMB & LDAP scanners. Exploited DC10 via ZeroLogon (CVE-2020-1472), dumped AD NTLM hashes with Impacket, performed Pass-the-Hash, then gained a Meterpreter reverse shell.

CVE-2020-1472MEDIUMsob ataqueransomware23 jul 2026

Netlogon Elevation of Privilege Vulnerability

100RISCO

abrir ↗

GitHub PoC

CVE Reproduction: cve-2025-5777-citrixbleed2_reproduction

CVE-2025-5777CRITICALsob ataqueransomware23 jul 2026

NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

100RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.