Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
84.035exploits catalogados
39.531CVEs com exploração pública
24.695testados em laboratório
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9.678Nuclei 4.478Metasploit 3.524✓ só verificadosrecentespopularesrisco
16.124 exploits
GitHub PoC
Vulhub spring/CVE-2022-22963: Spring Cloud Function SpEL Injection (CVE-2022-22963), run with Isoloom
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po
100RISCO
abrir ↗GitHub PoC
Vulhub jetty/CVE-2021-28164: Jetty Ambiguous Path Information Disclosure (CVE-2021-28164), run with Isoloom
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contai
70RISCO
abrir ↗GitHub PoC
Vulhub imagemagick/CVE-2022-44268: ImageMagick PNG Text Chunk Arbitrary File Read (CVE-2022-44268), run with Isoloom
ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulti
55RISCO
abrir ↗GitHub PoC
Vulhub elasticsearch/CVE-2014-3120: Elasticsearch MVEL Dynamic Script RCE (CVE-2014-3120), run with Isoloom
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
100RISCO
abrir ↗GitHub PoC
Vulhub cacti/CVE-2022-46169: Cacti remote_agent.php Command Injection (CVE-2022-46169), run with Isoloom
Unauthenticated Command Injection
100RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-105192 is a critical (CVSS 9.8) vulnerability in LMCache, an open-source distributed key-value cache for LLM inference engines like vLLM.
LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization
48RISCO
abrir ↗GitHub PoC
Vulhub rails/CVE-2019-5418: Ruby on Rails Accept Header File Disclosure (CVE-2019-5418), run with Isoloom
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where spe
100RISCO
abrir ↗GitHub PoC
Vulhub solr/CVE-2019-17558: Apache Solr Velocity Template RCE (CVE-2019-17558), run with Isoloom
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A V
100RISCO
abrir ↗GitHub PoC
Vulhub libssh/CVE-2018-10933: libssh Server Authentication Bypass (CVE-2018-10933), run with Isoloom
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul
85RISCO
abrir ↗GitHub PoC
Atlassian Data Center Multiple Products - Arbitrary File Access (Path Traversal)
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
63RISCO
abrir ↗GitHub PoC
hardeep-sudo/Keycloak-CVE-2026-18963-Exploit
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISCO
abrir ↗GitHub PoC
Vulhub tomcat/CVE-2017-12615: Tomcat 8.5.19 PUT JSP upload, run with Isoloom
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisati
100RISCO
abrir ↗GitHub PoC
Vulhub phpunit/CVE-2017-9841: PHPUnit eval-stdin.php RCE (CVE-2017-9841), run with Isoloom
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
100RISCO
abrir ↗GitHub PoC
Vulhub tomcat/CVE-2020-1938: Apache Tomcat AJP Ghostcat (CVE-2020-1938), run with Isoloom
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc
100RISCO
abrir ↗GitHub PoC
Vulhub samba/CVE-2017-7494: SambaCry on Samba 4.6.3, run with Isoloom
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
100RISCO
abrir ↗GitHub PoC
Vulhub drupal/CVE-2018-7600: Drupalgeddon 2 on Drupal 8.5.0, run with Isoloom
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-21589 — Atlassian DC pre-auth arbitrary file read (CVSS 4.0 9.3). PoCbit PoC: atlassian-plugins-webresource ..:: traversal on /download/resources/ for Jira, Confluence, Bitbucket. check + exploit (WEB-INF/web.xml, crowd.properties). Batch JSONL, hits.txt. Not RCE. https://pocbit.org/pocs/cve-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
63RISCO
abrir ↗GitHub PoC
Vulhub drupal/CVE-2014-3704: Drupal 7.31 Drupalgeddon SQL Injection (CVE-2014-3704), run with Isoloom
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct
60RISCO
abrir ↗GitHub PoC
Vulhub saltstack/CVE-2020-11651: SaltStack Master Authentication Bypass (CVE-2020-11651), run with Isoloom
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs cla
100RISCO
abrir ↗GitHub PoC
Vulhub bash/CVE-2014-6271: Shellshock through Apache CGI, run with Isoloom
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISCO
abrir ↗GitHub PoC
theendofabbys/CVE-2026-48907
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
98RISCO
abrir ↗GitHub PoC
Analisi e sfruttamento pratico della CVE-2026-46300 (Fragnesia) per l'ottenimento di Initial Access in un ambiente di test.
net: skbuff: preserve shared-frag marker during coalescing
56RISCO
abrir ↗GitHub PoC
Vulhub laravel/CVE-2021-3129: Laravel Ignition RCE (CVE-2021-3129), run with Isoloom
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra
100RISCO
abrir ↗GitHub PoC
Vulhub elasticsearch/CVE-2015-1427: Elasticsearch 1.4.2 Groovy sandbox escape, run with Isoloom
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
100RISCO
abrir ↗GitHub PoC
Уязвимая лаборатория WSO2 API Manager 4.5.0 в Docker, сканер и эксплойт для CVE-2026-5430 (обход аутентификации через поддельный HS256 JWT)
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
78RISCO
abrir ↗GitHub PoC
Detection PoC for CVE-2026-5430 — unauthenticated JWT algorithm bypass (CVSS 10.0) affecting WSO2 API Manager 4.1.0–4.6.0. Read-only assessment tool with patch confirmation and WAF detection. Authorized use only.
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
78RISCO
abrir ↗GitHub PoC
Vulhub httpd/CVE-2021-41773: Apache 2.4.49 path traversal and CGI RCE, run with Isoloom
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISCO
abrir ↗GitHub PoC
Vulhub postgres/CVE-2019-9193: PostgreSQL COPY FROM PROGRAM Command Execution (CVE-2019-9193), run with Isoloom
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
60RISCO
abrir ↗GitHub PoC
Vulhub ghostscript/CVE-2018-16509: Ghostscript -dSAFER Sandbox Bypass (CVE-2018-16509), run with Isoloom
An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handlin
60RISCO
abrir ↗GitHub PoC
Vulhub activemq/CVE-2016-3088: ActiveMQ Fileserver Arbitrary File Write (CVE-2016-3088), run with Isoloom
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitr
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.