Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.822 exploits
GitHub PoC★ 10
CVE-2026-109618 / CVE-2026-109619 Pre-auth RCE through PHP (session.upload_progress)
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
PHP2Shell（CVE-2026-109618 / CVE-2026-109619）兩天全紀錄：以 php.net 官方公告為主軸的繁中深度導讀
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 1
Free, read-only checker for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Finds every PHP build, detects vendor back-ports and unrestarted services, and prints next steps.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 2
Non-destructive network scanner for php2shell (CVE-2026-109618/CVE-2026-109619): version fingerprint + session-write oracle, Docker lab + test suite
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 4
Hunting pack for PHP2Shell (CVE-2026-109618/109619): find vulnerable PHP assets and hunt for exploitation with Microsoft Defender, Sentinel and Azure tooling
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 2
PHP 8.0.30 backport for CVE-2026-109618 / CVE-2026-109619 (Remi php80, EL7 RPMs)
RCE via OOM corruption
100RISCO
abrir ↗VulnCheck XDB
initial-access
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
100RISCO
abrir ↗GitHub PoC★ 2
Working RCE exploit, IDS/WAF detection rules (Suricata, ModSecurity, Sigma, Cloudflare), Docker lab, and full analysis for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Only public exploit covering the serializer mismatch → POP chain that bypasses upload_progress mitigations.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Check whether your own PHP 7.x-8.1 server still has the CVE-2026-109618 out-of-memory handling (install-on-server probe, not a scanner)
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Cybersecurity assignment on CVE-2026-97859, severity analysis, patching, and the Cyber Kill Chain.
Gitea API disclosure of private user social graph, keys and stars
33RISCO
abrir ↗GitHub PoC
Non-intrusive PHP2Shell assessment for CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Reproducer for CVE-2026-85315 — Apache Camel camel-grpc consumer exception disclosure (CWE-209). Camel Spring Boot + Camel Quarkus.
Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions
33RISCO
abrir ↗GitHub PoC★ 1
Python HTTP/HTTPS response inspection tool for authorized web security research related to PHP2Shell (CVE-2026-109618 and CVE-2026-109619).
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 2
Read-only verification PoC for CVE-2026-109618 / CVE-2026-109619 (php2shell). Checks PHP patch level remotely across a fleet, plus an on-host agent verifying every mitigation in the PHP advisories. No exploit code.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
PHP2Shell PHP CVE-2026-109618 and CVE-2026-109619 dorks
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
WAF rules, PHP hardening & detection for CVE-2026-109618/109619 (PHP2Shell). Lab-tested bridge until you patch - review before production use.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
PHP2Shell Evaluación de CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC★ 111
Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.
RCE via OOM corruption
100RISCO
abrir ↗VulnCheck XDB
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
abrir ↗GitHub PoC★ 17
Nodejs漏洞 CVE-2026-111497 POC
Out-of-Bounds Write in Google Brotli Decoder
70RISCO
abrir ↗GitHub PoC
PHP Portal Audit: URL-only risk signals for CVE-2026-109618 / CVE-2026-109619, runtime assessment and optional multipart reachability evidence. No exploitation.
RCE via OOM corruption
100RISCO
abrir ↗GitHub PoC
Passive check for Claude whether a website or server runs a PHP version affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619)
RCE via OOM corruption
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.