Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

80.051exploits catalogados

36.945CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.476Referência 23.442GitHub PoC 15.268VulnCheck XDB 8.970Nuclei 4.393Metasploit 3.502✓ só verificadosrecentes populares risco

80.057 exploits

GitHub PoC

CVE-2026-20262 - Draft

CVE-2026-20262MEDIUMsob ataque16 jun 2026

Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability

68RISCO

abrir ↗

VulnCheck XDB

info-leak

CVE-2024-23897CRITICALsob ataqueransomware16 jun 2026

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RISCO

abrir ↗

GitHub PoC★ 62

CVE-2026-41940 exploitation proof-of-concept project

CVE-2026-41940CRITICALsob ataqueransomware16 jun 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RISCO

abrir ↗

VulnCheck XDB

remote-with-credentials

CVE-2026-40217HIGH16 jun 2026

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/t

61RISCO

abrir ↗

GitHub PoC★ 1

A script that gives you the credentials of a Pterodactyl panel vulnerable to CVE-2025-49132

CVE-2025-49132CRITICAL16 jun 2026

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

75RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-50751CRITICALsob ataqueransomware16 jun 2026

User Authentication Bypass in VPN Remote Access and Mobile Access

100RISCO

abrir ↗

VulnCheck XDB

info-leak

CVE-2025-49132CRITICAL16 jun 2026

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

75RISCO

abrir ↗

GitHub PoC

Self-contained Docker reproduction and analysis of CVE-2024-23897, the Jenkins CLI arbitrary file read via the args4j @-syntax argument expansion.

CVE-2024-23897CRITICALsob ataqueransomware16 jun 2026

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RISCO

abrir ↗

GitHub PoC★ 1

PoC exploit for CVE-2025-55182 (React2Shell) — Pre-auth RCE in React Server Components | CVSS 10.0

CVE-2025-55182CRITICALsob ataqueransomware16 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

GitHub PoC

CVE-2026-50751 Mass Scanner

CVE-2026-50751CRITICALsob ataqueransomware16 jun 2026

User Authentication Bypass in VPN Remote Access and Mobile Access

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALsob ataqueransomware16 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

GitHub PoC

KovachVL/CVE-2026-55168

CVE-2026-55168MEDIUM16 jun 2026

Runtipi: Authenticated arbitrary file write via backup restore symlink planting

33RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-4480CRITICAL16 jun 2026

Samba: samba: remote code execution in printing subsystem via unescaped job description

68RISCO

abrir ↗

GitHub PoC

CVE-2026-47101, CVE-2026-47102, CVE-2026-40217

CVE-2026-47101HIGH16 jun 2026

LiteLLM < 1.83.14 Privilege Escalation via API Key Generation

41RISCO

abrir ↗

GitHub PoC

Kioptrix Level 1 writeup - CVE-2003-0201 Samba trans2open

CVE-2003-0201—16 jun 2026

Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x vers

60RISCO

abrir ↗

GitHub PoC★ 7

Manage and recover BitLocker encrypted drives with this tool for Windows 11 recovery key management and educational study of CVE-2026-45585.

CVE-2026-45585MEDIUM16 jun 2026

Windows BitLocker Security Feature Bypass Vulnerability

33RISCO

abrir ↗

GitHub PoC

0xdak/CVE-2026-44881_exploit

CVE-2026-44881HIGH16 jun 2026

Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Update

41RISCO

abrir ↗

GitHub PoC★ 1

Mass Scanner For Drupal Exploit CVE-2026-9082

CVE-2026-9082CRITICALsob ataque16 jun 2026

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

100RISCO

abrir ↗

GitHub PoC★ 2

mahfuzreham/litespeed-cpanel-cve-2026-54420-fix

CVE-2026-54420HIGHsob ataque16 jun 2026

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provide

71RISCO

abrir ↗

GitHub PoC★ 1

CVE-2026-54420

CVE-2026-54420HIGHsob ataque16 jun 2026

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provide

71RISCO

abrir ↗

GitHub PoC

This is an exploit poc for CVE-2026-4480

CVE-2026-4480CRITICAL16 jun 2026

Samba: samba: remote code execution in printing subsystem via unescaped job description

68RISCO

abrir ↗

GitHub PoC

rootdirective-sec/CVE-2026-10795-Lab

CVE-2026-10795HIGH15 jun 2026

UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc

41RISCO

abrir ↗

GitHub PoC

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint.

CVE-2026-37070MEDIUM15 jun 2026

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated

33RISCO

abrir ↗

VulnCheck XDB

client-side

CVE-2025-2783HIGHsob ataque15 jun 2026

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allow

71RISCO

abrir ↗

GitHub PoC

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'user_name' parameter to test if the user exists.

CVE-2026-37064MEDIUM15 jun 2026

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker

33RISCO

abrir ↗

GitHub PoC★ 3

PoC exploit for CVE-2026-53519.

CVE-2026-53519CRITICAL15 jun 2026

Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

63RISCO

abrir ↗

GitHub PoC★ 2

DylanZahedi/CVE-2026-9277

CVE-2026-9277CRITICAL15 jun 2026

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

48RISCO

abrir ↗

GitHub PoC

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request.

CVE-2026-37067MEDIUM15 jun 2026

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauth

33RISCO

abrir ↗

GitHub PoC

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint.

CVE-2026-37068HIGH15 jun 2026

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allow

41RISCO

abrir ↗

GitHub PoC

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header.

CVE-2026-37073MEDIUM15 jun 2026

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated a

33RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.