Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

79.980exploits catalogados

36.899CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.476Referência 23.400GitHub PoC 15.250VulnCheck XDB 8.959Nuclei 4.393Metasploit 3.502✓ só verificadosrecentes populares risco

79.980 exploits

GitHub PoC

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore.

CVE-2026-53753CRITICAL03 jul 2026

Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

63RISCO

GitHub PoC★ 2

Page Builder CK for Joomla - Unauthenticated SSRF / Remote File Write leading to PHP execution Exploiter

CVE-2026-56290CRITICAL03 jul 2026

Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0

75RISCO

GitHub PoC

Pardus Software Local Privilege Escalation PoC - affected from <= 1.0.4

CVE-2026-14459HIGH03 jul 2026

Argument Injection in TUBITAK BILGEM's pardus-software

41RISCO

VulnCheck XDB

info-leak

CVE-2024-1561HIGH03 jul 2026

Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio

56RISCO

GitHub PoC

Tracking IPV6_FRAG_ESCAPE (CVE-2026-53362, CVE-2026-53366), the IPv6 fragmentation container escape

CVE-2026-53362HIGHsob ataque03 jul 2026

ipv6: account for fraggap on the paged allocation path

71RISCO

VulnCheck XDB

initial-access

CVE-2017-12615HIGHsob ataqueransomware03 jul 2026

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisati

100RISCO

GitHub PoC★ 1

1beelze/CVE-2026-11387

CVE-2026-11387CRITICAL03 jul 2026

SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset

63RISCO

GitHub PoC★ 4

# CVE-2026-28995 Proof of Concept for CVE-2026-28995 — Path Traversal vulnerability in App Intents on iOS 26.4.2 and below.

CVE-2026-28995HIGH03 jul 2026

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 an

41RISCO

GitHub PoC

Walkthrough and PoC of File path traversal vulnerability(CVE-2026-36851) for UnPoller 2.33.0

CVE-2026-36851HIGH03 jul 2026

Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration.

41RISCO

GitHub PoC★ 2

CVE-2026-49468 — LiteLLM (<1.84.0) unauthenticated auth bypass via Host-header route confusion. PoC + docker lab.

CVE-2026-49468CRITICAL03 jul 2026

LiteLLM: Authentication Bypass via Host Header Injection

48RISCO

GitHub PoC

kn9annihilator/CVE-2011-2523-vsFTPd-2.3.4-Writeup

CVE-2011-2523—03 jul 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RISCO

GitHub PoC

Crawl4AI <= 0.8.6 pre-auth RCE via AST sandbox escape (gi_frame.f_back.f_builtins chain) — CVSS 10.0

CVE-2026-53753CRITICAL02 jul 2026

Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

63RISCO

GitHub PoC★ 3

CVE-2025-57819 - FreePBX Unauthenticated Remote Code Execution (RCE)

CVE-2025-57819CRITICALsob ataque02 jul 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISCO

GitHub PoC★ 1

Proof of concept for CVE-2026-36027 and CVE-2026-36028

CVE-2026-36027MEDIUM02 jul 2026

An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to execute arbitrary code via

33RISCO

GitHub PoC★ 1

FzRsLLaSheR/CVE-2026-12166_CVE-2026-12167_CVE-2026-12168

CVE-2026-12166MEDIUM02 jul 2026

CVE-2026-12166

33RISCO

GitHub PoC★ 7

SimpleHelp OIDC Authentication Bypass PoC

CVE-2026-48558CRITICAL02 jul 2026

SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

75RISCO

VulnCheck XDB

remote-with-credentials

CVE-2026-52813CRITICAL02 jul 2026

Gogs: Path Traversal in organization name results in RCE through Git hooks

48RISCO

GitHub PoC

DESIGN AND IMPLEMENTATION OF A VULNERABILITY SCANNER FOR CVE-2026-45498 IN MICROSOFT DEFENDER

CVE-2026-45498MEDIUMsob ataque02 jul 2026

Microsoft Defender Denial of Service Vulnerability

55RISCO

VulnCheck XDB

initial-access

CVE-2025-57819CRITICALsob ataque02 jul 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISCO

GitHub PoC

attarwahyup/Netscaler-CVE-2026-8451

CVE-2026-8451HIGH02 jul 2026

Insufficient input validation leading to memory overread

46RISCO

GitHub PoC

This repository contains a proof-of-concept (PoC) exploit for CVE-2026-38751, affecting OpenSTAManager ≤ 2.10. The vulnerability allows an authenticated attacker to upload a malicious module via the module update functionality, leading to arbitrary file upload and remote code execution (RCE).

CVE-2026-38751HIGH02 jul 2026

OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionali

41RISCO

GitHub PoC

Proof-of-concept exploit and lab environment for CVE-2026-25194

CVE-2026-25194LOW02 jul 2026

Out-of-bounds write in the firmware for the Intel(R) Slim Bootloader may allow a denial of service. System software adve

8RISCO

GitHub PoC★ 2

dinosn/CVE-2026-25243-debugfree

CVE-2026-25243HIGH02 jul 2026

redis-server RESTORE invalid memory access may allow remote code execution

41RISCO

GitHub PoC

Gogs has Path Traversal in organization name that results in RCE through Git hooks

CVE-2026-52813CRITICAL02 jul 2026

Gogs: Path Traversal in organization name results in RCE through Git hooks

48RISCO

GitHub PoC

BastianXploited/CVE-2026-0740-mass

CVE-2026-0740CRITICAL02 jul 2026

Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload

75RISCO

GitHub PoC

CVE-2026-55726: Publicly Listable Azure Blob Storage Container (device logs) - Gardyn (ICSA-26-183-03)

CVE-2026-55726MEDIUM02 jul 2026

Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere

33RISCO

GitHub PoC★ 2

Python POC, Exploit for CVE-2026-33017

CVE-2026-33017CRITICALsob ataque02 jul 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

100RISCO

GitHub PoC★ 1

kaleth4/CVE-2026-20896

CVE-2026-20896CRITICAL02 jul 2026

Gitea Docker image trusts spoofable reverse-proxy headers by default

63RISCO

GitHub PoC

CVE-2026-54477: Admin Panel Missing Security Headers (clickjacking/XSS) - Gardyn (ICSA-26-183-03)

CVE-2026-54477MEDIUM02 jul 2026

Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax

33RISCO

GitHub PoC

kaleth4/CVE-2026-55200

CVE-2026-55200CRITICAL02 jul 2026

libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c

48RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.