Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
71.666exploits catalogados
32.032CVEs com exploração pública
1.932testados em laboratório
TodosExploit-DB 22.786Referência 19.896GitHub PoC 13.204VulnCheck XDB 8.127Nuclei 4.191Metasploit 3.462✓ só verificadosrecentespopularesrisco
71.666 exploits
VulnCheck XDB
initial-access
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
75RISCO
abrir ↗GitHub PoC
CVE-2026-6274 - Redline WR3200 Broken Authentication
Authentication Bypass in DTS Electronics' Redline WR3200
28RISCO
abrir ↗GitHub PoC
Xmyronn/CVE-2026-10290-SQLI
code-projects Hotel and Tourism Reservation System GET Parameter tour.php sql injection
33RISCO
abrir ↗GitHub PoC
Xmyronn/CVE-2026-10288-AUTH-BYPASS
code-projects Hotel and Tourism Reservation System Admin Login login.php password_verify improper authentication
33RISCO
abrir ↗GitHub PoC
Proof of concept of CVE-2026-8161 (Multiparty)
multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception
21RISCO
abrir ↗GitHub PoC
Xmyronn/CVE-2026-10289-XSS
code-projects Hotel and Tourism Reservation System tour.php cross site scripting
33RISCO
abrir ↗GitHub PoC
PoC for CVE-2026-8023: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Path traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file read
41RISCO
abrir ↗GitHub PoC
SSTI contact form to rce
Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
75RISCO
abrir ↗GitHub PoC
CVE-2026-43284的rust版本实现
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISCO
abrir ↗GitHub PoC
EspoCRM 9.3.3 - Stored HTML Injection in Email Notifications
EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field
13RISCO
abrir ↗GitHub PoC★ 68
EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization.
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
61RISCO
abrir ↗GitHub PoC
CVE-2026-41940 — cPanel/WHM Auth Bypass By Dr.Anach, CRLF injection in `cpsrvd` Basic auth handler → unauthenticated WHM API access → RCE as root. All cPanel since v11.40 affected.
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISCO
abrir ↗GitHub PoC
CVE-2026-40987 PoC
Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization
41RISCO
abrir ↗VulnCheck XDB
initial-access
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISCO
abrir ↗VulnCheck XDB
initial-access
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISCO
abrir ↗VulnCheck XDB
info-leak
Relevanssi <= 4.24.4 (Free) and <= 2.27.5 (Premium) - Unauthenticated SQL Injection
56RISCO
abrir ↗GitHub PoC
Форензика после CVE-2026-41940 (cPanel/WHM) — bash-скрипт и чек-лист
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISCO
abrir ↗GitHub PoC★ 2
cPanelSniper STABLE - CVE-2026-41940 optimized for 10M+ targets
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISCO
abrir ↗VulnCheck XDB
initial-access
Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
75RISCO
abrir ↗VulnCheck XDB
initial-access
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISCO
abrir ↗GitHub PoC
rootdirective-sec/CVE-2026-42208-Lab
LiteLLM: SQL injection in Proxy API key verification
100RISCO
abrir ↗GitHub PoC
Threat intelligence brief on CVE-2026-42208, a critical pre-auth SQL injection in BerriAI LiteLLM exploited within 36 hours of disclosure. Covers attack path, detection opportunities, and recommended actions.
LiteLLM: SQL injection in Proxy API key verification
100RISCO
abrir ↗GitHub PoC★ 27
arm64/aarch64 port of V4bel/dirtyfrag (CVE-2026-43284). ESP-only - rxrpc path kernel-oopses on arm64 due to flush_dcache_page
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.