Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

84.035exploits catalogados

39.531CVEs com exploração pública

24.695testados em laboratório

Todos Referência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9.678Nuclei 4.478Metasploit 3.524✓ só verificadosrecentes populares risco

16.144 exploits

GitHub PoC

CVE-2026-92084 — Beaver Builder Lite <= 2.11.0.5 unauthenticated arbitrary shortcode execution via Sidebar module widget output (CVSS 9.1): Docker validation lab with vulnerable/patched controls, safe-oracle Python PoC, nuclei version screen. Authorized security research only.

CVE-2026-92084CRITICAL04 out 2026

Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output

48RISCO

GitHub PoC

TheJesterrrr/CVE-2026-19632

CVE-2026-19632CRITICAL04 out 2026

TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure

63RISCO

GitHub PoC

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

CVE-2026-90970CRITICAL03 out 2026

Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

48RISCO

GitHub PoC★ 8

CVE-2026-103956 - Loom for AWS - Critical - Auth bypass - unauthenticated super-admin when no IdP is configured

CVE-2026-103956CRITICAL03 out 2026

Missing authentication for critical function in Loom for AWS

48RISCO

GitHub PoC

A python3 PoC for CVE-2026-105030 Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API

CVE-2026-105030MEDIUM03 out 2026

Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API

33RISCO

GitHub PoC

Guest-to-host KVM/x86 escape exploiting CVE-2026-64561, delivering a full PoC chain and analysis for security researchers.

CVE-2026-64561HIGH03 out 2026

KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

41RISCO

GitHub PoC

VulnHub DC-1 boot2root — unauthenticated RCE via Drupalgeddon2 (CVE-2018-7600) to SUID find privilege escalation, with severity-rated findings and remediation.

CVE-2018-7600CRITICALsob ataqueransomware03 out 2026

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RISCO

GitHub PoC★ 2

CVE-2026-103648 | Path Traversal in image-downloader 4.3.0 | CVSS 9.1 Critical | CWE-22 | By EterNullSec

CVE-2026-103648CRITICAL03 out 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader

48RISCO

GitHub PoC

Hands-on Learn SecByte CTF labs covering Beelzebub preparation, VM and network clues, Base64, CVE-2026-14461, admin panels, authentication, credential leaks, kernel security, reused keys, SQLMap, and web-to-root concepts.

CVE-2026-14461MEDIUM03 out 2026

Out-of-bound read in mtr

33RISCO

GitHub PoC★ 3

Proof-of-concept scanner and exploit helper for CVE-2026-14378: unauthenticated administrator session takeover in the WordPress plugin DevKit Pro (dplugins) through a flawed user-switch “revert” flow.

CVE-2026-19660CRITICAL03 out 2026

Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter

48RISCO

GitHub PoC

Proof of concept for CVE-2026-92592: Craft CMS authenticated RCE

CVE-2026-92592HIGH03 out 2026

Craft CMS before 4.18.6 Remote Code Execution via signed cookie

41RISCO

GitHub PoC

CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept

CVE-2026-63030CRITICALsob ataque03 out 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RISCO

GitHub PoC★ 1

Unauthenticated Privilege Escalation Mass Exploit Super Forms <= 6.3.316 CVE-2026-15989

CVE-2026-15989CRITICAL03 out 2026

Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter

48RISCO

GitHub PoC

MotionEye OS Command Injection (CVE-2025-60787)

CVE-2025-60787HIGH03 out 2026

MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name

61RISCO

GitHub PoC

An end-to-end infrastructure penetration testing lab showcasing automated scanning (Nikto), remote code execution (CVE-2012-1823), and manual kernel privilege escalation to Root (CVE-2008-0600).

CVE-2008-0600—03 out 2026

The vmsplice_to_pipe function in Linux kernel 2.6.17 through 2.6.24.1 does not validate a certain userspace pointer befo

23RISCO

GitHub PoC

An end-to-end infrastructure penetration testing lab showcasing automated scanning (Nikto), remote code execution (CVE-2012-1823), and manual kernel privilege escalation to Root (CVE-2008-0600).

CVE-2012-1823CRITICALsob ataque03 out 2026

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

100RISCO

GitHub PoC

watchtowrlabs/citrix-netscaler-cve-2026-88771-iocs

CVE-2026-88771CRITICALsob ataque02 out 2026

A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

78RISCO

GitHub PoC

Unauthenticated RCE in Yamcs mission control via YAML injection in reconfigureInstance()

CVE-2026-55559CRITICAL02 out 2026

Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)

48RISCO

GitHub PoC★ 1

Meniben/redmi14c-pond-cve-2026-64560

CVE-2026-64560HIGH02 out 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RISCO

GitHub PoC★ 5

A python tool to detect PDF files exploiting CVE-2026-86950

CVE-2026-86950HIGHsob ataque02 out 2026

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 2

71RISCO

GitHub PoC

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

CVE-2026-103922CRITICAL02 out 2026

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

48RISCO

GitHub PoC

CVE-2026-102282: adm-zip LPE via SUID/SGID preservation during archive extraction (fixed in 0.6.1)

CVE-2026-102282HIGH02 out 2026

adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

41RISCO

GitHub PoC

Defensive analysis, patch breakdown, and passive detection scanner for CVE-2026-103752 (WordPress Authorizer Plugin <= 3.15.3).

CVE-2026-103752CRITICAL02 out 2026

WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability

48RISCO

GitHub PoC

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

CVE-2026-104286CRITICALsob ataque02 out 2026

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.

78RISCO

GitHub PoC

Penetration testing portfolio: FTP vulnerability assessment & exploitation in isolated lab. Demonstrates network reconnaissance, CVE-2011-2523 validation, and post-exploitation verification. Complete methodology with evidence, findings, and remediation guidance.

CVE-2011-2523—02 out 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RISCO

GitHub PoC★ 2

Sensitive info disclosure via info API in PictShare < 3.7.1 (CWE-522). PoC + advisory writeup.

CVE-2026-104051HIGH02 out 2026

PictShare < 3.7.1 Sensitive Information Disclosure via info API

41RISCO

GitHub PoC★ 4

Path Traversal -> RCE in Laranode < 1.2.1 (CWE-22). PoC + advisory writeup.

CVE-2026-100520HIGH02 out 2026

Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint

41RISCO

GitHub PoC★ 2

Predictable delete_code via rand() in PictShare < 3.7.1 (CWE-338). PoC + advisory writeup.

CVE-2026-104356HIGH02 out 2026

PictShare < 3.7.1 Predictable Delete Code via rand()

41RISCO

GitHub PoC★ 2

Exploited a known RCE vulnerability (PHP-CGI Argument Injection, CVE-2012-1823) on Metasploitable2 using Metasploit Framework, gained a shell, and documented post-exploitation

CVE-2012-1823CRITICALsob ataque02 out 2026

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

100RISCO

GitHub PoC

Out-of-bounds Write (CWE-787)

CVE-2026-86950HIGHsob ataque02 out 2026

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 2

71RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.