Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.526exploits catalogados

36.593CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.475Referência 23.152GitHub PoC 15.158VulnCheck XDB 8.883Nuclei 4.365Metasploit 3.493✓ só verificadosrecentes populares risco

14.991 exploits

GitHub PoC★ 1

Abdal CVE-2026-60137 is an advanced WordPress security scanner for identifying systems potentially affected by the CVE-2026-60137 SQL Injection vulnerability. Developed by Ebrahim Shafiei (EbraSha) for vulnerability assessment, security research, and authorized penetration testing.

CVE-2026-60137MEDIUMsob ataque18 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

100RISCO

GitHub PoC★ 10

wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on WP 6.9.0–6.9.4 / 7.0.0–7.0.1.

CVE-2026-60137MEDIUMsob ataque18 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

100RISCO

GitHub PoC

CVE-2021-3129: Laravel Debug Mode RCE - Complete exploitation lab with Python exploit, Docker container, and security analysis guide.

CVE-2021-3129CRITICALsob ataqueransomware18 jul 2026

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra

100RISCO

GitHub PoC★ 10

CVE-2026-63030 (wp2shell) POC.

CVE-2026-63030CRITICALsob ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISCO

GitHub PoC

akash-osmsec/CVE-2026-44262-

CVE-2026-44262CRITICAL18 jul 2026

Scramble: Remote code execution via evaluation of user-controlled input in validation rules

63RISCO

GitHub PoC

Lightweight scanner that detects vulnerable Log4j versions and Log4Shell (CVE-2021-44228) indicators in a filesystem tree.

CVE-2021-44228CRITICALsob ataqueransomware18 jul 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

GitHub PoC

Advisory for CVE-2026-51385. Needed to publish it as GRAPHIFY hasnt recognized the advisory neither publish it, and MITRE assigned CVE-2026-51385, this is the advisory for it.

CVE-2026-51385MEDIUM18 jul 2026

An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code v

33RISCO

GitHub PoC

tcyph3r/wp2shell-cve-2026-63030-root-cause

CVE-2026-63030CRITICALsob ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISCO

GitHub PoC

vivo X Fold6 (V2545A) GhostLock CVE-2026-43499 临时root/永久解锁研究

CVE-2026-43499HIGH18 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC

CVE-2026-43499

CVE-2026-43499HIGH18 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC

Het-Kalariya/CVE-2026-20253

CVE-2026-20253CRITICALsob ataque18 jul 2026

Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

100RISCO

GitHub PoC★ 4

Blackbox, non-intrusive detector for wp2shell (WordPress core pre-auth RCE, CVE-2026-63030 / CVE-2026-60137). Detection only.

CVE-2026-63030CRITICALsob ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISCO

GitHub PoC★ 2

wp2shell - WordPress RCE & PoC (CVE-2026-63030 + CVE-2026-60137)

CVE-2026-63030CRITICALsob ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISCO

GitHub PoC★ 59

Non-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1

CVE-2026-63030CRITICALsob ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISCO

GitHub PoC

mrx-arafat/CVE-2026-63030-POC

CVE-2026-63030CRITICALsob ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISCO

GitHub PoC

Pentest completo sobre Metasploitable: recon con nmap, explotación con Metasploit (CVE-2007-2447), extracción y cracking de credenciales, persistencia SSH

CVE-2007-2447—17 jul 2026

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands

50RISCO

GitHub PoC

jaf0rk/CVE-2026-14431

CVE-2026-14431HIGH17 jul 2026

Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside

41RISCO

GitHub PoC★ 759

wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain

CVE-2026-63030CRITICALsob ataque17 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISCO

GitHub PoC★ 1

MiaPatsune/cve-2026-43499

CVE-2026-43499HIGH17 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RISCO

GitHub PoC

Reproducer for CVE-2026-47323: Apache Camel CXF/Knative HeaderFilterStrategy missing inbound filtering, enabling Camel control-header injection (RCE via camel-exec) through CXF-RS/CXF-SOAP/Knative endpoints (fixed in 4.14.6/4.18.2/4.19.0)

CVE-2026-47323CRITICAL17 jul 2026

Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering

48RISCO

GitHub PoC★ 1

CVE-2026-55579 – Unauthenticated RCE in Pheditor via hardcoded default password "admin". Full Python exploit with file upload & terminal execution. No dependencies.

CVE-2026-55579CRITICAL17 jul 2026

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

48RISCO

GitHub PoC

tungduongNT/CVE-2014-0160.

CVE-2014-0160HIGHsob ataque17 jul 2026

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISCO

GitHub PoC★ 58

CVE-2026-63030, CVE-2026-60137, wp2shell scanner

CVE-2026-63030CRITICALsob ataque17 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RISCO

GitHub PoC★ 4

HIKRAVEN - Advanced Hikvision Security Assessment Platform for professional penetration testing. Detects 12+ CVEs including CVE-2021-36260 (CRITICAL), tests default credentials, performs network discovery, and generates professional security reports. For authorized security testing only! 🛡️🔒

CVE-2021-36260CRITICALsob ataque17 jul 2026

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

100RISCO

GitHub PoC★ 45

CVE-2026-50416: Windows 11 KASLR bypass

CVE-2026-50416LOW17 jul 2026

Win32k Information Disclosure Vulnerability

28RISCO

GitHub PoC★ 1

Reproducer for CVE-2026-48205: Apache Camel camel-dns dns.* header injection redirecting DNS queries to an attacker-controlled resolver (SSRF via DNS) and enabling internal-hostname reconnaissance (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-48205CRITICAL17 jul 2026

Apache Camel DNS: The dns.* and term Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour

48RISCO

GitHub PoC

CVE-2026-38526 Exploit | by infrar3d

CVE-2026-38526CRITICAL17 jul 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RISCO

GitHub PoC★ 5

CVE-2026-15409/15410 SonicWall SMA1000 multi-exploit Framework 🔥 SSRF→Erlang RPC→RCE→root privesc. Features: --detect safe check, --exec, --read-file, --privesc, --rpc, interactive shell, batch threading, file write, ws-url override, pipe support.🛡️ KEV listed CVSS 10.0 actively exploited. Authorized testing only. Use Ethically, Stay Legal. 🔒

CVE-2026-15409CRITICALsob ataqueransomware17 jul 2026

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A

100RISCO

GitHub PoC

Python port of the CVE-2023-23752 exploit — Joomla! < 4.2.8 unauthenticated information disclosure (user list + DB credentials leak)

CVE-2023-23752MEDIUMsob ataque17 jul 2026

[20230201] - Core - Improper access check in webservice endpoints

100RISCO

GitHub PoC★ 1

bekwiner/cve-2026-47777

CVE-2026-47777HIGH17 jul 2026

Mastodon has a consent-check bypass in its remote Collections

41RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.