Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.055exploits catalogados
40.803CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.350VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.520 exploits
GitHub PoC
Go app using Coraza WAF (CVE-2026-114101 bypass)
Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass
33RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-109618 / CVE-2026-109619 - one-shot pre-auth RCE on stock PHP 8.4.26 (Apache mod_php), single-file pure-HTTP PoC
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Read-only PowerShell scanner: finds PHP installs on Windows hosts and reports PHP2Shell (CVE-2026-109618, CVE-2026-109619) exposure. RMM-friendly exit codes and CSV. Tillnet, MIT.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Node.js app using adm-zip (CVE-2026-114102 DoS)
adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event
41RISCO
abrir ↗GitHub PoC★ 1
Check Linux servers and Docker containers for PHP versions affected by CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). Includes a copy-and-paste Bash script.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
CVE-2026-109618 — PHP pre-auth UAF RCE: root-cause analysis (EN/FR), Nuclei detection, transcript. Defensive/educational.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Bluefire Redteam checker for Ivanti Connect Secure CVE-2026-104935. Version and reachability only.
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arb
100RISCO
abrir ↗VulnCheck XDB
initial-access
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
100RISCO
abrir ↗GitHub PoC★ 3
CVE-2026-109618 / CVE-2026-109619 PHP PoC and exploit tool (single-file Go)
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 1
Log-only Cloudflare WAF rule to detect php2shell (CVE-2026-109618 / CVE-2026-109619) targeting
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 1
Educational Docker labs for PHP CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Scans a PHP host for CVE-2026-109619 (php2shell): fingerprints it, compares PHP version and build date against fixed releases, checks the advisory's producer and consumer preconditions, then prints a VULNERABLE, NOT VULNERABLE or UNKNOWN verdict with the evidence behind it.
RCE via stale global state
100RISCO
abrir ↗GitHub PoC★ 1
Unofficial patches for PHP CVE-2026-109618 / CVE-2026-109619 (RCE, CVSS 9.2) on EOL platforms: PHP 7.3 on CentOS/RHEL 7 (Remi), PHP 5.4 on Amazon Linux 2, PHP 5.3 on Amazon Linux 1
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
PHP2Shell (CVE-2026-109618/109619) one-click detect & fix tool
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Writeup + PoC for CVE-2026-104068: JetBackup (WordPress) symlink arbitrary file write via backup restore (fixed 3.1.24.10)
JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore
41RISCO
abrir ↗GitHub PoC
Source + build recipe for the php2shell (CVE-2026-109618/109619) backport to CentOS 7 / IUS PHP 7.2
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 78
Reproducible local Brotli decoder proof for CVE-2026-111497 with a self-checking tuned RCE harness
Out-of-Bounds Write in Google Brotli Decoder
70RISCO
abrir ↗GitHub PoC★ 1
Read-only, on-server PHP2Shell (CVE-2026-109618/109619) check. Finds every PHP runtime (CLI, FPM, mod_php, cPanel/Plesk), distro backports, workers still needing a restart, and signs of compromise. No exploit traffic, changes nothing.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
PoC and verification material for CVE-2026-63077 (JetBrains TeamCity agent-polling deserialization RCE)
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin
100RISCO
abrir ↗GitHub PoC★ 1
Go edition of the php2shell lab: CVE-2026-109618/109619 Docker lab, chain verifiers, WAF middleware and detection rules.
RCE via OOM corruption
100RISCO
abrir ↗VulnCheck XDB
initial-access
Laravel TokenGuard authentication bypass through non-string API credentials
63RISCO
abrir ↗GitHub PoC
Deterministic Edge Radar & Reverse Proxy in Rust: Sniffing Autonomous AI Agents, mutating botnets, and PHP-2-Shell (CVE-2026-109618/19) memory exploits.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 4
Patches and Windows build scripts for PHP 5.6-7.4 fixing CVE-2026-109618 / CVE-2026-109619
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 1
Find CA bundles in venvs, node_modules, wheels, jars, container images and binaries that still trust a revoked CA (eMudhra 2026, CVE-2026-111943) and the package to upgrade. Offline Rust CLI, SARIF output.
Distrust compromised intermediate certificates in crypto/x509
33RISCO
abrir ↗GitHub PoC★ 4
Unofficial rebuild of PHP 7.4 for EL7 (CentOS/RHEL 7) with the php2shell fix (CVE-2026-109618/109619). A stopgap for EOL stacks — upgrading is the real fix.
RCE via OOM corruption
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.