Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
84.035exploits catalogados
39.531CVEs com exploração pública
24.695testados em laboratório
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9.678Nuclei 4.478Metasploit 3.524✓ só verificadosrecentespopularesrisco
16.124 exploits
GitHub PoC
Technical advisory and proof of concept for CVE-2026-97286 in the WordPress Strong Testimonials plugin
WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability
33RISCO
abrir ↗GitHub PoC★ 10
MarcusProgram/CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
63RISCO
abrir ↗GitHub PoC★ 6
Zammad Session Leak to Remote Code Execution
Undisclosed RCE in Zammad v6.3 and higher
71RISCO
abrir ↗GitHub PoC
PoC for CVE-2025-55182
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC
CVE-2025-55182 "Ghost Action" — pre-auth RCE (React Flight deserialization, Next.js 15.5.6) CTF challenge. Problem only; solve/writeup excluded.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC
beyavuz/cve-2026-105080-poc
In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-conve
48RISCO
abrir ↗GitHub PoC
CVE-2026-59265
Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover
41RISCO
abrir ↗GitHub PoC
Upstream OpenVPN kernel fix for CVE-2026-74727, tested on Ubuntu kernel 7.0.0-38.38. Includes build instructions and functional test results.
ovpn: skip rehash for peers already removed from by_id
48RISCO
abrir ↗GitHub PoC★ 14
watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
63RISCO
abrir ↗GitHub PoC★ 1
PHP Object Injection -> Arbitrary File Deletion in FacturaScripts <= 2026.66 (CWE-502). PoC + advisory.
FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect
33RISCO
abrir ↗GitHub PoC
CVE-2026-63277,
RCE via calcext:data-mappings, sql provider and jdbc connector
41RISCO
abrir ↗GitHub PoC
CVE-2023-54391: Proxmox VE Authentication Bypass RCE
Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
63RISCO
abrir ↗GitHub PoC★ 9
CVE-2026-21589 - Atlassian Data Center Unauth Arbitrary File Read (CVSS 9.3). Red/Blue Team suite with 2 tools: Full Exploit (path traversal, WEB-INF read, interactive shell, 8 products, mass scan, SOCKS5/Tor, stealth) and SafeChecker (non-intrusive version audit, WAF detection, IoC guidance, JSON/CSV/JSONL reports). Use Ethically, Stay Legal.
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
63RISCO
abrir ↗GitHub PoC
Python 3 reverse-shell exploit for Zenphoto <= 1.4.1.4 / CVE-2011-4825 (EDB-18083)
Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinym
50RISCO
abrir ↗GitHub PoC
CVE-2026-105221 - gist RubyGem - High - MITM - GitHub OAuth token theft
Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification
48RISCO
abrir ↗GitHub PoC
PoC for CVE-2026-67401 — cPanel/WHM EmailTrack SQL injection leading to arbitrary file write and root RCE. Includes a self-contained vulnerable lab, SQLi detection, and full exploit chain.
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTr
48RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-96940
Microsoft Exchange Server Elevation of Privilege Vulnerability
41RISCO
abrir ↗GitHub PoC★ 2
CVE-2023-54391: Proxmox VE Authentication Bypass RCE Exploit
Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
63RISCO
abrir ↗GitHub PoC★ 1
CVE-2026-57967 PoC — Apache ActiveMQ Artemis unauthenticated session hijacking via SESSION_REATTACH (2.50.0–2.56.0)
Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
48RISCO
abrir ↗GitHub PoC★ 1
0xCyp1337/CVE-2026-10196
Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields
48RISCO
abrir ↗GitHub PoC
One-day analysis + sanitizer PoC of CVE-2026-43805 (IOKit IODMACommand DriverKit RPC race, CWE-362)
A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequ
48RISCO
abrir ↗GitHub PoC
Penetration test for Metasploitable 2 — Samba 3.0.20 Username Map Script (CVE-2007-2447)
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands
50RISCO
abrir ↗GitHub PoC
Educational lab and clean-room reproduction demonstrating the OS command injection pattern in CVE-2026-105134. For defensive research only.
Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
78RISCO
abrir ↗GitHub PoC
CVE-2026-39987 Exploit | by infrar3d
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISCO
abrir ↗GitHub PoC
CVE-2024-4367 PDF.js FontMatrix injection PoC (payload: alert(1)) - authorized pentest artifact
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RISCO
abrir ↗GitHub PoC
Analysis of CVE-2026-86881: An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages
A certificate validation issue was addressed with improved certificate validation. This issue is fixed in iOS 26.7 and i
48RISCO
abrir ↗GitHub PoC
Xen0nize/CVE-2026-21096
Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attac
48RISCO
abrir ↗GitHub PoC
CVE-2026-86950
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 2
71RISCO
abrir ↗GitHub PoC
PoC and automated code to exploit CVE-2025-57819 in FreePBX. It demonstrates the Remote Code Execution (RCE) vulnerability via command injection in the Asterisk system. Ideal for HackTheBox environments.
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RISCO
abrir ↗GitHub PoC
CVE-2026-16444 — Arbitrary file write on the controller via TeamViewer Classical File Transfer (TV-2026-1008)
Improper Validation of File Paths in TeamViewer Desktop Clients
41RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.