Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

88.056exploits catalogados

40.804CVEs com exploração pública

24.696testados em laboratório

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentes populares risco

87.900 exploits

GitHub PoC★ 5

CVE-2026-85097 – Bricksforge WordPress Plugin Unauth File Upload to RCE Toolkit (CVSS 10.0) | Red/Blue Team suite for Bricksforge Pro Forms < 3.1.8.9. 2 tools: Full Exploit (polyglot upload, web shell, mass scan, OPSEC, SQLite/JSON output) + SafeChecker (version detect, non-intrusive audit). Ethical & educational use only.

CVE-2026-85097CRITICAL12 out 2026

Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

63RISCO

GitHub PoC

Working PoC + debugging writeup for CVE-2025-32432 (Craft CMS pre-auth RCE)

CVE-2025-32432CRITICALsob ataque12 out 2026

Craft CMS Allows Remote Code Execution

100RISCO

GitHub PoC

Independent reconstruction, lab validation, and PoC for CVE-2026-72898 — Metabase unauthenticated SQLi (patched in 0.63.5)

CVE-2026-72898CRITICALsob ataque12 out 2026

Metabase SQL injection via password reset endpoint

100RISCO

GitHub PoC

Unauthenticated RCE in WordPress Forminator Forms <= 1.56.1 (CVSS 9.8)

CVE-2026-15748CRITICAL11 out 2026

Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration

48RISCO

VulnCheck XDB

initial-access

CVE-2025-57819CRITICALsob ataque11 out 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISCO

VulnCheck XDB

info-leak

CVE-2020-1938CRITICALsob ataque11 out 2026

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc

100RISCO

GitHub PoC

FreePBX unauthenticated SQLi (endpoint module)

CVE-2025-57819CRITICALsob ataque11 out 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISCO

VulnCheck XDB

initial-access

CVE-2025-24813CRITICALsob ataque11 out 2026

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RISCO

VulnCheck XDB

remote-with-credentials

CVE-2017-11610—11 out 2026

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows rem

60RISCO

GitHub PoC

Binary diff analysis and non-destructive PoC for CVE-2026-43805

CVE-2026-43805CRITICAL11 out 2026

A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequ

48RISCO

GitHub PoC★ 533

cPanel & WHM Authentication Bypass via CVE-2026-41940 explotation

CVE-2026-41940CRITICALsob ataqueransomware11 out 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RISCO

GitHub PoC★ 6

CVE-2026-102489 exploit in golang

CVE-2026-102489HIGHsob ataque11 out 2026

Undisclosed RCE in Zammad v6.3 and higher

83RISCO

GitHub PoC

Farih123/CVE-2026-104335

CVE-2026-104335HIGH11 out 2026

Langflow OSS is affected by multiple vulnerabilities

41RISCO

GitHub PoC

CVE-2026-105306: Token Introspection Audience Bypass via Dynamic Client Registration in Keycloak - Writeup by DungSoCool

CVE-2026-105306MEDIUM11 out 2026

Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration

33RISCO

VulnCheck XDB

initial-access

CVE-2026-102489HIGHsob ataque11 out 2026

Undisclosed RCE in Zammad v6.3 and higher

83RISCO

GitHub PoC

ctroy999/CVE-2026-107406

CVE-2026-107406CRITICAL11 out 2026

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service

48RISCO

GitHub PoC★ 1

Reactor es una máquina Linux fácil vulnerable a CVE-2025-55182 (React2Shell), RCE sin autenticación en React Server Components. Accedemos como node, crackeamos un hash MD5 de una base de datos SQLite y pivotamos a engineer por SSH. La escalada abusa del flag --inspect de Node.js para ejecutar código como root vía depuración V8.

CVE-2025-55182CRITICALsob ataqueransomware11 out 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

GitHub PoC

PoC CVE-2026-104286 FortiMail

CVE-2026-104286CRITICALsob ataque11 out 2026

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.

78RISCO

GitHub PoC

toyplan/cve-2025-24813

CVE-2025-24813CRITICALsob ataque11 out 2026

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RISCO

VulnCheck XDB

initial-access

CVE-2026-15748CRITICAL11 out 2026

Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration

48RISCO

GitHub PoC

KyrieKlay/CVE-2026-37107

CVE-2026-37107CRITICAL10 out 2026

An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php com

48RISCO

VulnCheck XDB

info-leak

CVE-2026-21589CRITICALsob ataque10 out 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RISCO

GitHub PoC

CVE-2026-102428 PoC: OrdaSoft Joomla OS CCK (com_os_cck) <=8.3.15 unauth SQLi — order_field/order_direction ORDER BY injection on public listings. Check + mass exploit, POCBIT-102428-OK marker, CVSS 9.3. https://pocbit.org/pocs/cve-2026-102428

CVE-2026-102428CRITICAL10 out 2026

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16

48RISCO

VulnCheck XDB

initial-access

CVE-2026-94503CRITICAL10 out 2026

WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

48RISCO

GitHub PoC

SQL injection (CWE-89) in itsourcecode Leave Management System 1.0 - CVE-2026-103690 / VulDB VDB-412559

CVE-2026-103690MEDIUM10 out 2026

itsourcecode Leave Management System controller.php sql injection

33RISCO

GitHub PoC

CVE-2026-84411 — MikroTik RouterOS WebFig Integer Underflow Exploit

CVE-2026-84411CRITICAL10 out 2026

MikroTik RouterOS Integer Underflow

48RISCO

GitHub PoC

webserverdude/f5_CVE-2026-21589_mitigation

CVE-2026-21589CRITICALsob ataque10 out 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

100RISCO

GitHub PoC★ 1

Bricksforge <= 3.1.8.9 Unauthenticated Arbitrary File Upload

CVE-2026-85097CRITICAL10 out 2026

Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

63RISCO

GitHub PoC★ 12

Reproducible macOS automountd research and lab PoCs for CVE-2026-84568 and CVE-2026-84570: fstype path traversal, NFS payload delivery, Gatekeeper behavior, and root code execution.

CVE-2026-84568HIGH10 out 2026

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS S

41RISCO

GitHub PoC★ 2

CVE-2026-106445 — Handlebars 4.0.0–4.7.9 RCE via Function.prototype.constructor bypass (GHSA-p8wg-vrv2-v86f). PoCbit PoC + Docker lab (4.7.9), check/exploit HTTP client, GHSA template chain. Fixed 4.7.10. https://pocbit.org/pocs/cve-2026-106445

CVE-2026-106445CRITICAL10 out 2026

Handlebars: JavaScript Injection via Own Property Check Bypass

48RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.