Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.899 exploits
GitHub PoC
CVE-2026-104711 POC - Brand New
Apache Struts: OGNL injection in the legacy RESTful action mapper
28RISCO
abrir ↗GitHub PoC★ 2
ABC00012345/CVE-2026-74580
vhost: reset the vring metadata cache on vring reconfiguration
41RISCO
abrir ↗GitHub PoC★ 8
abdugafforov-bobur/cve-2026-107181-poc
Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
41RISCO
abrir ↗Metasploit400
Cisco Secure Email Gateway AMP Arbitrary File Write RCE
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
73RISCO
abrir ↗GitHub PoC
For WordPress
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
63RISCO
abrir ↗VulnCheck XDB
initial-access
Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
56RISCO
abrir ↗GitHub PoC★ 2
Wazuh PoC chaining CVE-2026-74034 file read and CVE-2026-74041 command execution; fixed in 4.14.8. Python standard library only.
Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
41RISCO
abrir ↗GitHub PoC★ 1
SQL Injection via identifier injection in SLiMS 9.8.0 admin AJAX endpoints (tableName/tableFields). Any authenticated staff can dump password hashes.
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/A
48RISCO
abrir ↗GitHub PoC
CVE-2026-106991 report
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sti
41RISCO
abrir ↗GitHub PoC
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
vhost: reset the vring metadata cache on vring reconfiguration
41RISCO
abrir ↗GitHub PoC★ 46
wkpwn/CVE-2026-83834
Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability
41RISCO
abrir ↗GitHub PoC
Autonomous submission for "Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability" (MSRC / GitHub Security Advisory)
ASP.NET Core Remote Code Execution Vulnerability
41RISCO
abrir ↗GitHub PoC★ 1
Heartbleed (CVE-2014-0160) reproduction and analysis —CSP Application Security project
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RISCO
abrir ↗GitHub PoC
sohel160/Webfig-jsproxy-unauthenticated-file-read-CVE-2026-67281-
Unauthenticated file read in Mikrotik RouterOS
41RISCO
abrir ↗GitHub PoC★ 2
Exploit para explotar la vulnerabilidad CVE-2020-25213 en WPFileManager < 6.9
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra
100RISCO
abrir ↗GitHub PoC
Defensive exposure checker and poc for cURL CVE-2026-92392
HTTP/2 upload Use-After-Free
41RISCO
abrir ↗GitHub PoC★ 26
Mr-Ochobot/CVE-2016-5195
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISCO
abrir ↗VulnCheck XDB
initial-access
Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
100RISCO
abrir ↗GitHub PoC
EndlssNightmare/CVE-2026-18116
Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications
41RISCO
abrir ↗GitHub PoC
V8 inlined Array.prototype.sort elements-kind confusion - PoC + addrof (N-day research)
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside
71RISCO
abrir ↗VulnCheck XDB
info-leak
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside
71RISCO
abrir ↗VulnCheck XDB
initial-access
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra
100RISCO
abrir ↗VulnCheck XDB
info-leak
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16
100RISCO
abrir ↗GitHub PoC★ 3
Unauthenticated privilege escalation in SimpleForm WordPress plugin <= 3.10.0. Registers an administrator account without authentication
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
48RISCO
abrir ↗GitHub PoC
CVE-2026-104748 POC
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
48RISCO
abrir ↗VulnCheck XDB
remote-with-credentials
Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products
60RISCO
abrir ↗VulnCheck XDB
info-leak
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
60RISCO
abrir ↗GitHub PoC
Bilingual PoC and technical analysis for CVE-2026-105950 — Formwork formaction URI sanitizer bypass
getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting
33RISCO
abrir ↗GitHub PoC
anaskalt/CVE-2026-104944
Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500
41RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.