Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.795 exploits
GitHub PoC★ 991
High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
BIBILZERODAY/CVE-2026-102785---YooTheme-Mass-Exploit-Webshell.Store-
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52
48RISCO
abrir ↗GitHub PoC
PoC and verification material for CVE-2026-63077 (JetBrains TeamCity agent-polling deserialization RCE)
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin
100RISCO
abrir ↗GitHub PoC
Corrección de PHP2Shell (CVE-2026-109618 / CVE-2026-109619) para PHP 7.2, 7.3 y 7.4 en servidores CentOS / RHEL / Rocky / AlmaLinux / CloudLinux. Funciona con cPanel, CloudLinux, Plesk, DirectAdmin, Remi, el PHP del sistema o PHP compilado a mano. El script instala el código de la corrección. No es una mitigación de configuración.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Production-grade defensive CLI to audit, patch, and hunt PHP2Shell (CVE-2026-109618/19) memory-safety exploits without downtime.
RCE via OOM corruption
100RISCO
abrir ↗VulnCheck XDB
initial-access
Laravel TokenGuard authentication bypass through non-string API credentials
63RISCO
abrir ↗GitHub PoC★ 78
Reproducible local Brotli decoder proof for CVE-2026-111497 with a self-checking tuned RCE harness
Out-of-Bounds Write in Google Brotli Decoder
70RISCO
abrir ↗GitHub PoC
Security audit notes for CVE-2025-29927 (Next.js middleware authorization bypass) - upgrade plan for architecture review
Authorization Bypass in Next.js Middleware
85RISCO
abrir ↗GitHub PoC
php-backport:7.4-apache PHP-7.4-CVE-2026-109618-109619
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 1
FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients.
FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length
33RISCO
abrir ↗GitHub PoC
Node.js app using adm-zip (CVE-2026-114102 DoS)
adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event
41RISCO
abrir ↗GitHub PoC★ 1
Unofficial patches for PHP CVE-2026-109618 / CVE-2026-109619 (RCE, CVSS 9.2) on EOL platforms: PHP 7.3 on CentOS/RHEL 7 (Remi), PHP 5.4 on Amazon Linux 2, PHP 5.3 on Amazon Linux 1
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 1
Detection for the critical PHP RCE flaws CVE-2026-109618 and CVE-2026-109619. Reports vulnerable/patched/EOL PHP runtimes by version and config.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
PHP2Shell (CVE-2026-109618/CVE-2026-109619) multi-server scanner, guarded Linux/Windows remediation scripts, incident report and rollback guidance.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 1
Honeypot to attract attacks for php2shell (CVE-2026-109618 and CVE-2026-109619)
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Detecteur CVE-2026-109618 / CVE-2026-109619 (php2shell) pour image Docker ou binaire PHP
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 1
PHP 5.6.40 fix for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Rebuilds of patched ondrej/php PHP 8.1, 8.0, 7.4, 7.3 and 5.6 packages for Ubuntu 20.04 (CVE-2026-109618, CVE-2026-109619)
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 1
One-shot RCE proof of concept for the PHP session.upload_progress use-after-free vulnerabilities (CVE-2026-109618 / CVE-2026-109619).
RCE via OOM corruption
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.