Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.114exploits catalogados

31.649CVEs com exploração pública

0testados em laboratório

Todos Exploit-DB 22.469Referência 19.810GitHub PoC 13.116VulnCheck XDB 8.069Nuclei 4.188Metasploit 3.462✓ só verificadosrecentes populares risco

13.116 exploits

GitHub PoC

Xmyronn/CVE-2026-11518-XSS

CVE-2026-11518MEDIUM23 mai 2026

SourceCodester Inventory System User Management users.php cross site scripting

33RISCO

abrir ↗

GitHub PoC

webdev75950-ux/nginx-rce-cve-2026-42945

CVE-2026-42945CRITICAL23 mai 2026

NGINX ngx_http_rewrite_module vulnerability

60RISCO

abrir ↗

GitHub PoC

cPanel user run arbitrary scripts as root

CVE-2026-48172CRITICALsob ataque23 mai 2026

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild i

83RISCO

abrir ↗

GitHub PoC

Ethical Hacking Assessment | Practical vulnerability testing of vsftpd 2.3.4 backdoor (CVE-2011-2523) on Metasploitable2 using Kali Linux & Metasploit

CVE-2011-2523—23 mai 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RISCO

abrir ↗

GitHub PoC

Google Dorks for detecting CMS Made Simple < 2.2.10 SQL Injection (CVE-2019-9053). Built for security auditing and patch verification.

CVE-2019-9053—23 mai 2026

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RISCO

abrir ↗

GitHub PoC★ 1

Unauthenticated Privilege Escalation CVE-2026-9018: Easy Elements for Elementor

CVE-2026-9018HIGH23 mai 2026

Easy Elements for Elementor – Addons & Website Templates <= 1.4.5 - Unauthenticated Privilege Escalation via 'custom_meta' Parameter

41RISCO

abrir ↗

GitHub PoC

CVE-2026-6279: Avada (Fusion) Builder <= 3.15.2 – Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler (fusion-builder)

CVE-2026-6279CRITICAL23 mai 2026

Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

48RISCO

abrir ↗

GitHub PoC★ 3

CVE-2026-6279 — Avada Builder <= 3.15.2 Unauthenticated RCE via call_user_func()

CVE-2026-6279CRITICAL23 mai 2026

Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

48RISCO

abrir ↗

GitHub PoC★ 8

R3n3r0/CVE-2026-20700

CVE-2026-20700HIGHsob ataque23 mai 2026

A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3,

71RISCO

abrir ↗

GitHub PoC

Private exploit

CVE-2026-41940CRITICALsob ataqueransomware23 mai 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RISCO

abrir ↗

GitHub PoC

CVE-2026-41901

CVE-2026-41901CRITICAL23 mai 2026

Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions

48RISCO

abrir ↗

GitHub PoC

Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload

CVE-2026-4885CRITICAL23 mai 2026

Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload

48RISCO

abrir ↗

GitHub PoC

CVE-2026-6960: BookingPress Pro <= 5.6 – Unauthenticated Arbitrary File Upload

CVE-2026-6960CRITICAL23 mai 2026

BookingPress Pro <= 5.6 - Unauthenticated Arbitrary File Upload via Signature Custom Field

48RISCO

abrir ↗

GitHub PoC

Langflow remote code execution exploit

CVE-2026-0770CRITICAL23 mai 2026

Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability

68RISCO

abrir ↗

GitHub PoC

CVE-2025-46822

CVE-2025-46822HIGH23 mai 2026

Unauthenticated Arbitrary File Read via Absolute Path

56RISCO

abrir ↗

GitHub PoC★ 1

renewablehacking/CVE-2025-55182-React-19.2.0

CVE-2025-55182CRITICALsob ataqueransomware23 mai 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

GitHub PoC

felisha-elmer/Sandbox-Challenge-Log4Shell-CVE-2021-44228-

CVE-2021-44228CRITICALsob ataqueransomware23 mai 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

abrir ↗

GitHub PoC

CVE-2026-0926 exploit. The Prodigy Commerce plugin for WordPress Local File Inclusion

CVE-2026-0926CRITICAL23 mai 2026

Prodigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]

63RISCO

abrir ↗

GitHub PoC★ 1

CVE-2018-13379 mass exploiter for Fortinet FortiOS SSL VPN. Extracts credentials instantly, saves to CSV + PostgreSQL. Multi-threaded, no bullshit warnings.

CVE-2018-13379CRITICALsob ataqueransomware23 mai 2026

An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.

100RISCO

abrir ↗

GitHub PoC

mein-0/cve-2025-7771

CVE-2025-7771HIGH23 mai 2026

Code Execution / Escalation of Privileges in ThrottleStop

41RISCO

abrir ↗

GitHub PoC

logis11/CVE-2025-55423-analysis-and-reproduction

CVE-2025-55423CRITICAL22 mai 2026

A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the contr

48RISCO

abrir ↗

GitHub PoC

Portable Python PoC for CVE-2026-31431 (Copy Fail)

CVE-2026-31431HIGHsob ataque22 mai 2026

crypto: algif_aead - Revert to operating out-of-place

100RISCO

abrir ↗

GitHub PoC

A Go implementation of PinTheft (CVE-2026-43494)

CVE-2026-43494HIGH22 mai 2026

net/rds: reset op_nents when zerocopy page pin fails

41RISCO

abrir ↗

GitHub PoC★ 1

Detect whether a Strapi instance is vulnerable to CVE-2026-27886 (unauthenticated boolean-oracle exfiltration of administrator secrets).

CVE-2026-27886CRITICAL22 mai 2026

Strapi may leak sensitive data via relational filtering due to lack of query sanitization

48RISCO

abrir ↗

GitHub PoC

BastianXploited/CVE-2026-8181

CVE-2026-8181CRITICAL22 mai 2026

Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover

68RISCO

abrir ↗

GitHub PoC

This vulnerability allows unauthenticated attackers who know a valid administrator username to impersonate that admin during REST API requests by using any incorrect password in a Basic Authentication header. Attackers could abuse this flaw to create a new administrator account without prior authentication.

CVE-2026-8181CRITICAL22 mai 2026

Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover

68RISCO

abrir ↗

GitHub PoC★ 1

PoC for CVE-2026-42945 (nginx Rift) — heap buffer overflow in ngx_http_rewrite_module. Includes detect/probe/exploit modes, dual-fixture Docker lab, empirical address discovery, OOB-verified offset sweep. Original disclosure by depthfirst.

CVE-2026-42945CRITICAL22 mai 2026

NGINX ngx_http_rewrite_module vulnerability

60RISCO

abrir ↗

GitHub PoC

Pumila03/CVE-2026-6009

CVE-2026-6009HIGH22 mai 2026

Jaspersoft Library Deserialisation Vulnerability

41RISCO

abrir ↗

GitHub PoC★ 2

A safe read-only Linux check for CVE-2026-31431 / Copy Fail without running exploit code.

CVE-2026-31431HIGHsob ataque22 mai 2026

crypto: algif_aead - Revert to operating out-of-place

100RISCO

abrir ↗

GitHub PoC★ 3

CVE-2026-20182 PoC - Cisco Catalyst SD-WAN Controller / Manager Authentication Bypass (CVSS 10.0)

CVE-2026-20182CRITICALsob ataque22 mai 2026

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

100RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.