Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.900exploits catalogados

36.847CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.475Referência 23.360GitHub PoC 15.228VulnCheck XDB 8.946Nuclei 4.390Metasploit 3.501✓ só verificadosrecentes populares risco

15.228 exploits

GitHub PoC★ 1

CVE-2026-38165 (SSTI)

CVE-2026-38165CRITICAL18 jun 2026

A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2

48RISCO

abrir ↗

GitHub PoC

CVE-2026-48907 is a critical improper access control vulnerability in the JCE editor extension for Joomla. It allows unauthenticated attackers to create new editor profiles, which can ultimately lead to arbitrary PHP file upload and remote code execution on affected systems

CVE-2026-48907CRITICALsob ataque17 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISCO

abrir ↗

GitHub PoC

mandeepsohal/CVE-2025-66391

CVE-2025-66391HIGH17 jun 2026

In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o

41RISCO

abrir ↗

GitHub PoC

CVE-2026-49104 Integration for Keap/Infusionsoft PHP Object Injection Exploit

CVE-2026-49104CRITICAL17 jun 2026

WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability

48RISCO

abrir ↗

GitHub PoC

CVE-2026-48907

CVE-2026-48907CRITICALsob ataque17 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISCO

abrir ↗

GitHub PoC

d4ngkh04w/CVE-2020-7961

CVE-2020-7961CRITICALsob ataque17 jun 2026

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c

100RISCO

abrir ↗

GitHub PoC

CVE-2026-49083 LatePoint Calendar Booking Plugin Privilege Escalation Exploit

CVE-2026-49083HIGH17 jun 2026

WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability

41RISCO

abrir ↗

GitHub PoC

The project documents the completion and analysis of the Fragnesia (CVE-2026-46300) TryHackME lab, which demonstrates a Linux kernel page -cache corruption vulnerability capable of achieving local privilege escalation through modification of cached file pages without altering files on disk.

CVE-2026-46300HIGH17 jun 2026

net: skbuff: preserve shared-frag marker during coalescing

56RISCO

abrir ↗

GitHub PoC★ 3

Chaining Security Bugs in Discuz! X5.0: from Race Condition to Pre-Auth RCE

CVE-2026-49952CRITICAL17 jun 2026

Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle

63RISCO

abrir ↗

GitHub PoC

hulina9900-boop/DIY-CVE-2026-42945-POC

CVE-2026-42945CRITICAL17 jun 2026

NGINX ngx_http_rewrite_module vulnerability

60RISCO

abrir ↗

GitHub PoC

CVE-2026-7654 Admin Columns PHP Object Injection RCE Exploit

CVE-2026-7654HIGH17 jun 2026

Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value

41RISCO

abrir ↗

GitHub PoC

CVE-2026-5415 WP Captcha PRO Authenticated Authentication Bypass Exploit

CVE-2026-5415HIGH17 jun 2026

WP Captcha PRO <= 5.38 - Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link

41RISCO

abrir ↗

GitHub PoC

Log4Shell (CVE-2021-44228) 보안 실습 환경 - Log4j 2.14.1 취약 로그 수집 서버

CVE-2021-44228CRITICALsob ataqueransomware17 jun 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

abrir ↗

GitHub PoC

CVE-2026-5411 WP Captcha PRO

CVE-2026-5411HIGH17 jun 2026

WP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

41RISCO

abrir ↗

GitHub PoC★ 144

PACKET_EDIT_MEME.c (aka CVE-2026-46331): yet another page cache poisoning nightmare

CVE-2026-46331HIGH17 jun 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RISCO

abrir ↗

GitHub PoC

CVE-2026-42758 WebinarIgnition Exploit

CVE-2026-42758CRITICAL17 jun 2026

WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability

48RISCO

abrir ↗

GitHub PoC

CVE-2026-9691: Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule

CVE-2026-9691CRITICAL17 jun 2026

WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability

48RISCO

abrir ↗

GitHub PoC

rootdirective-sec/CVE-2026-49060-Lab

CVE-2026-49060CRITICAL17 jun 2026

WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability

48RISCO

abrir ↗

GitHub PoC

87achrafg-stack/CVE-2026-49083

CVE-2026-49083HIGH17 jun 2026

WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability

41RISCO

abrir ↗

GitHub PoC

CVE-2026-39808 - Fortinet Sandbox - Draft

CVE-2026-39808CRITICALsob ataque17 jun 2026

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F

100RISCO

abrir ↗

GitHub PoC

CVE-2026-39813 - Fortinet Sandbox - Draft

CVE-2026-39813CRITICAL17 jun 2026

A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.

53RISCO

abrir ↗

GitHub PoC

CVE-2026-49105 WP Zendesk PHP Object Injection Exploit

CVE-2026-49105CRITICAL17 jun 2026

WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability

48RISCO

abrir ↗

GitHub PoC

CVE-2026-7459 Simple History Missing Authorization Account Takeover Exploit

CVE-2026-7459HIGH17 jun 2026

Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint

41RISCO

abrir ↗

GitHub PoC★ 1

PoC de CVE-2026-20262: escritura arbitraria de archivos por path traversal en Cisco Catalyst SD-WAN Manager (autenticado).

CVE-2026-20262MEDIUMsob ataque17 jun 2026

Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability

68RISCO

abrir ↗

GitHub PoC

CVE-2026-7465 Spectra Gutenberg Blocks Authenticated RCE Exploit

CVE-2026-7465HIGH17 jun 2026

Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes

41RISCO

abrir ↗

GitHub PoC

CVE-2026-45777 PoC

CVE-2026-45777CRITICAL17 jun 2026

Open XDMoD Vulnerable to Unauthenticated Remote Code Execution (RCE) via OS Command Injection

28RISCO

abrir ↗

GitHub PoC

This project documents the completion and analysis of the Fragnesia (CVE-2026-46300) TryHackMe lab, which demonstrates a Linux kernel page-cache corruption vulnerability capable of achieving local priviledge escalation through modification of cached file pages without altering files on disk.

CVE-2026-46300HIGH17 jun 2026

net: skbuff: preserve shared-frag marker during coalescing

56RISCO

abrir ↗

GitHub PoC

segunakinsoyinu/CVE-2024-42009-roundcube-xss

CVE-2024-42009CRITICALsob ataque17 jun 2026

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea

100RISCO

abrir ↗

GitHub PoC

CVE-2026-49085 WP Insightly PHP Object Injection Exploit

CVE-2026-49085CRITICAL17 jun 2026

WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability

48RISCO

abrir ↗

GitHub PoC

akpmarcelin/CVE-2026-24061-lab

CVE-2026-24061CRITICALsob ataque17 jun 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.