Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
85.337exploits catalogados
39.873CVEs com exploração pública
24.696testados em laboratório
TodosReferência 25.822Exploit-DB 24.487GitHub PoC 17.115VulnCheck XDB 9.874Nuclei 4.511Metasploit 3.528✓ só verificadosrecentespopularesrisco
17.115 exploits
GitHub PoC
CVE-2026-91843 - Draft or TODO
Stack overflow in login process to the Security Management and Log Servers
48RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-77991 - joomlaeventmanager.net - Critical - Privileged POST /administrator/index.php - Remote Code Execution
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1
48RISCO
abrir ↗GitHub PoC
WP Import Export Lite < 3.9.33 - Authenticated Path Traversal to Sensitive File Disclosure
WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal
33RISCO
abrir ↗GitHub PoC
Log4Shell (CVE-2021-44228) security review documentation and advisory triage
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
abrir ↗GitHub PoC
Tracking the Unbound CVE-2026-81642 DNSKEY digest heap overflow
Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY
48RISCO
abrir ↗GitHub PoC
Enumerate Grafana plugin enumeration PoC for CVE-2021-43798
Grafana path traversal
100RISCO
abrir ↗GitHub PoC★ 565
CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISCO
abrir ↗GitHub PoC
CVE-2026-77179 - Draft or TODO
Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback
48RISCO
abrir ↗GitHub PoC
CVE-2026-82226 - Tickera - Critical 9.8 - Unauthenticated POST /cart/ - PHP Object Injection
WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability
48RISCO
abrir ↗GitHub PoC
Device-bound CVE-2026-64560 adaptation for RedMi K80pro miro OS 3.0.304.0
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
41RISCO
abrir ↗GitHub PoC
Tracking PPPoEject (CVE-2026-68121), the Linux kernel PPPoE sendmsg use-after-free
pppoe: reload header pointer after dev_hard_header()
41RISCO
abrir ↗GitHub PoC
Tracking DirtyAH6 (CVE-2026-80844), the Linux kernel IPv6 AH routing-header out-of-bounds write
xfrm: ah6: validate routing header segments_left
23RISCO
abrir ↗GitHub PoC
CVE-2026-18574 - Draft or TODO
Authentication Bypass in Check Point Security Management Server
48RISCO
abrir ↗GitHub PoC
CVE-2026-45140 - chamilo - Critical 9.8 - Unauthenticated POST /plugin/CStudio/editor/import-project... - Remote Code Execution
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
48RISCO
abrir ↗GitHub PoC★ 2
CVE-2026-93453 Exploit — SOGo password reset link poisoning via attacker-controlled Origin header, enabling password reset token interception and account takeover.
SOGo before 5.12.11 Password Reset Token Interception via Origin Header
41RISCO
abrir ↗GitHub PoC
Security advisory and research notes for CVE-2026-16265 affecting the WP Maps WordPress plugin.
WP Maps < 4.9.7 - Subscriber+ Denial of Service
33RISCO
abrir ↗GitHub PoC
Security advisory and research notes for CVE-2026-18464 affecting the WP Maps Pro WordPress plugin.
WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service
41RISCO
abrir ↗GitHub PoC
CVE-2026-75827 - getgrav - High 8.8 - Unauthenticated GET /poc-form - Arbitrary File Write
Grav before 2.0.15 Arbitrary File Write via error_log
48RISCO
abrir ↗GitHub PoC
Tracking TUNderflow (CVE-2026-81000), the Linux kernel TUN/TAP receive-headroom underflow
net: tun: bound receive headroom
41RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-84753 - WPFunnels - Critical 9.8 - Unauthenticated POST /?rest_route=/mint-mail/v1/mint-form-... - PHP Object Injection
WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability
48RISCO
abrir ↗GitHub PoC
Tracking DiagSpill (CVE-2026-74469), the Linux kernel SCTP sock_diag heap overflow
sctp: prevent peer transport count overflow
41RISCO
abrir ↗GitHub PoC
A Python-based security tool for checking sudo versions for potential exposure to CVE-2021-3156 (Baron Samedit). Designed for authorized security testing and learning.
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISCO
abrir ↗GitHub PoC★ 2
CVE-2026-76460
Cisco Identity Services Engine Authentication Bypass Vulnerability
98RISCO
abrir ↗GitHub PoC★ 1
SneakyNachos/CVE-2026-85048-the-gpu-died
Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the
41RISCO
abrir ↗GitHub PoC
CVE-2026-12793 - JetFormBuilder Unauthorized RCE (CRITICAL 9.8)
JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
48RISCO
abrir ↗GitHub PoC★ 4
PoC for CVE-2026-67401 — cPanel/WHM EmailTrack SQL injection leading to arbitrary file write and root RCE. Includes a self-contained vulnerable lab, SQLi detection, and full exploit chain.
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTr
48RISCO
abrir ↗GitHub PoC★ 3
Unbounded memory allocation in NanaZip's UFS handler via an attacker-controlled `fs_bsize` field.
NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields
28RISCO
abrir ↗GitHub PoC
Isolated educational FreePBX-compatible cyber range for CVE-2025-57819 (CWE-89/CWE-288). Docker lab — not official Sangoma FreePBX.
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RISCO
abrir ↗GitHub PoC★ 1
Forensic Analysis and Local Replication of the OpenAI-Artifactory Privilege Escalation Incident (CVE-2026-65616)
Potential privilege escalation to JFrog administrator privileges
41RISCO
abrir ↗GitHub PoC
CVE-2026-85706
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.