Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

89.220exploits catalogados

41.197CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.738Exploit-DB 24.490GitHub PoC 18.525VulnCheck XDB 11.299Nuclei 4.626Metasploit 3.542✓ só verificadosrecentes populares risco

89.220 exploits

GitHub PoC★ 2

SQL Injection vulnerability in NASA EOSDIS MODAPS due to improper input validation in the `category` parameter. This flaw allows attackers to manipulate backend SQL queries, potentially leading to unauthorized data access and database compromise.

CVE-2024-46636CRITICAL22 abr 2026

NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection v

48RISCO

VulnCheck XDB

initial-access

CVE-2026-32201MEDIUMsob ataque22 abr 2026

Microsoft SharePoint Server Spoofing Vulnerability

75RISCO

VulnCheck XDB

client-side

CVE-2023-4863HIGHsob ataque22 abr 2026

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to

93RISCO

VulnCheck XDB

local

CVE-2019-2215HIGHsob ataque22 abr 2026

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

100RISCO

GitHub PoC

Multi-Stage Attack Modeling and Detection of Log4Shell for CVE-2021-44228

CVE-2021-44228CRITICALsob ataqueransomware22 abr 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

GitHub PoC

Sanitized advisory for CVE-2025-51846 affecting CryptPad WebSocket handling.

CVE-2025-51846HIGH22 abr 2026

CryptPad unbounded WebSocket frame flood

41RISCO

GitHub PoC★ 4

Full exploit for the Android vulnerability Bad Binder found in early Google Pixel phones.

CVE-2019-2215HIGHsob ataque22 abr 2026

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

100RISCO

Exploit-DB

WordPress Plugin 5.2.0 - Broken Access Control

CVE-2025-67586MEDIUMwebappsmultiple22 abr 2026

WordPress Highlight and Share plugin <= 5.2.0 - Broken Access Control vulnerability

33RISCO

VulnCheck XDB

info-leak

CVE-2022-1026HIGH22 abr 2026

Kyocera Net View Address Book Exposure

61RISCO

Exploit-DB

Throttlestop Kernel Driver - Kernel Out-of-Bounds Write Privilege Escalation

CVE-2025-7771HIGHlocalwindows22 abr 2026

Code Execution / Escalation of Privileges in ThrottleStop

41RISCO

GitHub PoC★ 4

Hack The Box - Silentium machine writeup | CVE-2025-58434, CVE-2025-59528, CVE-2025-8110

CVE-2025-58434CRITICAL22 abr 2026

Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

85RISCO

Metasploit600

Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload

CVE-2026-41459MEDIUM22 abr 2026

Xerte Online Toolkits Path Disclosure via /setup

48RISCO

Metasploit600

Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload

CVE-2026-34413HIGH22 abr 2026

Xerte Online Toolkits Missing Authentication via connector.php

56RISCO

Metasploit600

Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload

CVE-2026-34415CRITICAL22 abr 2026

Xerte Online Toolkits File Upload RCE via elfinder Connector

63RISCO

Metasploit600

Flowise CSV Agent Prompt Injection RCE

CVE-2026-41264CRITICAL22 abr 2026

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

43RISCO

Metasploit600

Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload

CVE-2026-34414HIGH22 abr 2026

Xerte Online Toolkits Path Traversal via connector.php

56RISCO

GitHub PoC

Cybersecurity lab demonstrating exploitation of CVE-2017-0144 (EternalBlue) using Metasploit against a vulnerable Windows 7 VM, achieving SYSTEM-level access via Meterpreter. Includes full attack chain, post exploitation, and mitigation via MS17-010 patching, tested in an isolated ethical lab environment.

CVE-2017-0144HIGHsob ataqueransomware22 abr 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISCO

GitHub PoC

CVEs-Labs/CVE-2026-21876

CVE-2026-21876CRITICAL22 abr 2026

OWASP CRS has multipart bypass using multiple content-type parts

53RISCO

GitHub PoC★ 1

Analysis and exploit for CVE-2026-25250, a Secure Boot bypass in Horizon DataSys Reboot Restore where shdloader.efi loads Shield.efi without verification.

CVE-2026-25250MEDIUM22 abr 2026

EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot

33RISCO

GitHub PoC

ClaraSto/CVE-2024-1086_Ausarbeitung

CVE-2024-1086HIGHsob ataqueransomware21 abr 2026

Use-after-free in Linux kernel's netfilter: nf_tables component

76RISCO

GitHub PoC★ 1

(RCE) vulnerability discovered in Ghost CMS (specifically affecting versions 0.7.2 through 6.19.0)

CVE-2026-29053HIGH21 abr 2026

Ghost Vulnerable to Remote Code Execution via Malicious Themes

56RISCO

Metasploit600

BerriAI LiteLLM Proxy MCP Test Endpoint Command Execution

CVE-2026-42271HIGHsob ataque21 abr 2026

LiteLLM: Authenticated command execution via MCP stdio test endpoints

100RISCO

Metasploit300

BerriAI LiteLLM Proxy Pre-Auth SQL Injection Scanner

CVE-2026-42208CRITICALsob ataque20 abr 2026

LiteLLM: SQL injection in Proxy API key verification

100RISCO

GitHub PoC

micheaol/distccd_rce_CVE-2004-2687

CVE-2004-2687—20 abr 2026

distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote at

60RISCO

GitHub PoC★ 1

Jorrit-VM/CVE-2026-33017

CVE-2026-33017CRITICALsob ataque20 abr 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

100RISCO

GitHub PoC

We hope to reproduce CVE-2021-41773 to deepen our understanding of real-world cybersecurity vulnerabilities so that we can be knowledgeable about exploits in industry and academic work.

CVE-2021-41773HIGHsob ataqueransomware20 abr 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

VulnCheck XDB

initial-access

CVE-2024-3400CRITICALsob ataqueransomware20 abr 2026

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

100RISCO

GitHub PoC

Multi-VLAN virtual network across 10 VMs: GRE tunneling, nftables firewall, Active Directory, BIND9 DNS, Kea DHCP, Docker web services, SMB file sharing. Vulnerability assessment using OWASP ZAP (Stored XSS) and Nessus (CVE-2017-0144 EternalBlue). Validated with Wireshark.

CVE-2017-0144HIGHsob ataqueransomware20 abr 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISCO

VulnCheck XDB

local

CVE-2021-3493HIGHsob ataque20 abr 2026

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o

98RISCO

GitHub PoC★ 79

Apache ActiveMQ漏洞综合利用工具(CVE-2015-5254，CVE-2016-3088，CVE-2022-41678，CVE-2023-46604，CVE-2024-32114，CVE-2026-34197，CVE-2026-40466， CVE-2026-42588)

CVE-2026-34197HIGHsob ataque20 abr 2026

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

100RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.