Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.899 exploits
GitHub PoC
Bilingual PoC and technical analysis for CVE-2026-105950 — Formwork formaction URI sanitizer bypass
getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting
33RISCO
abrir ↗GitHub PoC
POC for the CVE-2026-104711
Apache Struts: OGNL injection in the legacy RESTful action mapper
28RISCO
abrir ↗GitHub PoC
CVE-2026-108924: didactic PoC for Kirby dynamic option authorization bypass
getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization
33RISCO
abrir ↗VulnCheck XDB
initial-access
angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Explo
75RISCO
abrir ↗VulnCheck XDB
local
The Ancillary Function Driver (AFD) in afd.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vis
23RISCO
abrir ↗GitHub PoC★ 1
Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length.
Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length
41RISCO
abrir ↗GitHub PoC★ 37
CVE-85884 POC
Windows Health and Optimized Experiences Service Elevation of Privilege Vulnerability
41RISCO
abrir ↗GitHub PoC
Test d’intrusion sur Metasploitable 2 : exploitation de la backdoor vsftpd 2.3.4 (CVE-2011-2523) pour obtenir un accès root sans authentification.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISCO
abrir ↗VulnCheck XDB
info-leak
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISCO
abrir ↗VulnCheck XDB
initial-access
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISCO
abrir ↗VulnCheck XDB
client-side
Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to po
100RISCO
abrir ↗VulnCheck XDB
initial-access
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
63RISCO
abrir ↗VulnCheck XDB
local
Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon A
71RISCO
abrir ↗Metasploit400
GitLab CI/CD RegExp Integer Overflow Remote Code Execution
Integer Overflow or Wraparound in GitLab
100RISCO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗VulnCheck XDB
initial-access
Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
63RISCO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC★ 8
CVE-2026-91737 Chrome renderer RCE PoC (PDFium)
Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside
41RISCO
abrir ↗GitHub PoC
AraxyAI/CVE-2026-92956__vm2__test__20261012
vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
48RISCO
abrir ↗GitHub PoC★ 1
Proof of concept and isolated Docker lab for CVE-2026-103889, an unauthenticated RCE vulnerability in Expivi 3D Product Configurator for WooCommerce ≤ 2.16.2.
3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter
48RISCO
abrir ↗GitHub PoC
CVE-2026-91136 Divi Plus <= 2.4.0 unauthenticated arbitrary file read (mass scanner + exploit)
Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter
56RISCO
abrir ↗GitHub PoC
CVE-2026-104082, CVE-2026-104083, CVE-2026-104084
SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount
41RISCO
abrir ↗GitHub PoC★ 5
CVE-2026-85097 – Bricksforge WordPress Plugin Unauth File Upload to RCE Toolkit (CVSS 10.0) | Red/Blue Team suite for Bricksforge Pro Forms < 3.1.8.9. 2 tools: Full Exploit (polyglot upload, web shell, mass scan, OPSEC, SQLite/JSON output) + SafeChecker (version detect, non-intrusive audit). Ethical & educational use only.
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
63RISCO
abrir ↗GitHub PoC
Unencrypted JWT Transmission in War Thunder's Initial Client-Server Handshake
War Thunder Account Impersonation
33RISCO
abrir ↗GitHub PoC★ 1
For new CVEs without existing/working/non-mangled POCs
Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB
98RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.