Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
79.900exploits catalogados
36.847CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.475Referência 23.360GitHub PoC 15.228VulnCheck XDB 8.946Nuclei 4.390Metasploit 3.501✓ só verificadosrecentespopularesrisco
15.228 exploits
GitHub PoC
xxconi/CVE-2026-4782
Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
33RISCO
abrir ↗GitHub PoC★ 3
CVE-2026-10520 - CVE-2026-10523 - Ivanti Sentry
An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allow
60RISCO
abrir ↗GitHub PoC
CVE-2026-11551: Branda Plugin - Unauthenticated Privilege Escalation via Account Takeover
Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover
48RISCO
abrir ↗GitHub PoC
Повышение привилегий через race condition в polkit
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile
91RISCO
abrir ↗GitHub PoC★ 1
Unauthenticated Privilege Escalation via Account Takeover
Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover
48RISCO
abrir ↗GitHub PoC
AlexMihailEngineer/CVE-2026-11784-Optimole-CSRF
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action
33RISCO
abrir ↗GitHub PoC
Exploitability PoC for CVE-2026-43515 (Apache Tomcat constraint bypass).
Apache Tomcat: Security constraints not correctly applied
48RISCO
abrir ↗GitHub PoC
CVE-2026-7515: BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion TO RCE EXPLOİT
BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style
48RISCO
abrir ↗GitHub PoC★ 4
Scanner PoC for CVE-2026-42530 -- nginx 1.31.0-1.31.1 HTTP/3 QPACK encoder stream Use-After-Free (CVSS 9.2)
NGINX Open-Source ngx_http_v3_module vulnerability
48RISCO
abrir ↗GitHub PoC
Fortinet FortiSandbox 4.4.0-4.4.8 - OS Command Injection via tracer-behavior Endpoint
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F
100RISCO
abrir ↗GitHub PoC
Root-Level RCE via OS Command Injection in Ivanti Sentry
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote
85RISCO
abrir ↗GitHub PoC★ 2
Full-chain CVE-2025-57819 PoC for FreePBX 15, 16, and 17: unauthenticated SQLi to RCE and root takeover.
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RISCO
abrir ↗GitHub PoC
PoC de CVE-2026-54420: explotacion via symlink en el plugin LiteSpeed de cPanel/WHM.
LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provide
71RISCO
abrir ↗GitHub PoC
Store vulnerability POC files including CVE-2026-42588 Spring RCE xml payload
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector
41RISCO
abrir ↗GitHub PoC
A PoC/exploit written in python for the unauthenticated SQL injection vulnerability CVE-2026-3359 situated within Form Maker (version <= 1.15.42) by 10Web.
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'
41RISCO
abrir ↗GitHub PoC
A local lab for studying, reproducing, and verifying the patch for CVE-2026-42208: an unauthenticated SQL injection in LiteLLM's API key authentication path.
LiteLLM: SQL injection in Proxy API key verification
100RISCO
abrir ↗GitHub PoC
Defensive lab validation and SOC detection guidance for CVE-2026-48907 in Joomla JCE <= 2.9.99.4, including Apache/Joomla/auditd telemetry, webshell artifacts, Sigma rules, MITRE ATT&CK mapping and mitigation recommendations.
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISCO
abrir ↗GitHub PoC★ 4
Detection scripts, patch checker & hardening guide for CVE-2026-44963 (Veeam B&R RCE)
A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.
48RISCO
abrir ↗GitHub PoC★ 1
Reproduction lab for CVE-2026-54316 (Claude Code WebFetch huggingface.co bare-hostname permission bypass / exfiltration)
Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch
33RISCO
abrir ↗GitHub PoC
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection
63RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-38165 (SSTI)
A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2
48RISCO
abrir ↗GitHub PoC★ 1
Defensive lab validation and SOC detection guidance for CVE-2026-48907 in Joomla JCE <= 2.9.99.4, including Apache/Joomla/auditd telemetry, webshell artifacts, Sigma rules, MITRE ATT&CK mapping and mitigation recommendations.
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISCO
abrir ↗GitHub PoC★ 11
0xCyberstan/CVE-2026-46215-POC
drm: Set old handle to NULL before prime swap in change_handle
41RISCO
abrir ↗GitHub PoC
CVE-2025-6254 — Doctreat Core <= 1.6.8 — Unauthenticated Privilege Escalation
Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation
48RISCO
abrir ↗GitHub PoC★ 2
CVE-2025-54123 Hoverfly Command Injection to RCE PoC
Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation
68RISCO
abrir ↗GitHub PoC★ 1
A web version of the bash scripts wrote for Check Point CVE-2026-50751 and CVE-2026-50752. This uses a local server to scan and make changes using Check Point Web API
User Authentication Bypass in VPN Remote Access and Mobile Access
100RISCO
abrir ↗GitHub PoC★ 1
Unauthenticated Local File Inclusion
BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style
48RISCO
abrir ↗GitHub PoC★ 1
Unauthenticated RCE exploit for Veritas Backup Exec Agent (CVE-2021-27876/77/78) — SHA auth bypass to SYSTEM via NDMP
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires suc
91RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.