Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

80.095exploits catalogados

36.945CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.476Referência 23.442GitHub PoC 15.312VulnCheck XDB 8.970Nuclei 4.393Metasploit 3.502✓ só verificadosrecentes populares risco

80.095 exploits

GitHub PoC★ 4

CVE-2026-35273

CVE-2026-35273CRITICALsob ataqueransomware12 jun 2026

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mana

100RISCO

abrir ↗

GitHub PoC★ 2

CVE-2026-35273

CVE-2026-35273CRITICALsob ataqueransomware12 jun 2026

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mana

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALsob ataqueransomware12 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-53435HIGH12 jun 2026

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrar

53RISCO

abrir ↗

GitHub PoC

CVE-2026-0273 - Draft

CVE-2026-0273MEDIUM12 jun 2026

PAN-OS: Authenticated Admin Command Injection Vulnerability via CLI or Web UI

33RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-50751CRITICALsob ataqueransomware12 jun 2026

User Authentication Bypass in VPN Remote Access and Mobile Access

100RISCO

abrir ↗

GitHub PoC★ 13

watchtowrlabs/watchTowr-vs-Splunk-CVE-2026-20253

CVE-2026-20253CRITICALsob ataque12 jun 2026

Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

100RISCO

abrir ↗

GitHub PoC

rootdirective-sec/CVE-2026-46645-Analysis-Lab

CVE-2026-46645MEDIUM12 jun 2026

SQLAdmin: Authorization Bypass on `ajax_lookup`

33RISCO

abrir ↗

GitHub PoC

Chains CVE-2025-57819 (stacked query SQL injection) and CVE-2025-61678 (authenticated file upload in FreePBX Endpoint Manager) to achieve Remote Code Execution (RCE). For educational use only.

CVE-2025-57819CRITICALsob ataque12 jun 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISCO

abrir ↗

GitHub PoC★ 4

Toolkit for CVE-2025-55182, also known as React2Shell.

CVE-2025-55182CRITICALsob ataqueransomware12 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

GitHub PoC

Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter

CVE-2026-8809CRITICAL12 jun 2026

Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter

48RISCO

abrir ↗

GitHub PoC

CVE-2026-49777 - ShapedPlugin Product Slider Pro for WooCommerce Backdoor RCE

CVE-2026-49777CRITICAL12 jun 2026

WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability

63RISCO

abrir ↗

GitHub PoC

This project simulates a real-world attack-and-defend scenario across two virtual machines. You will exploit a critical pre-authentication RCE vulnerability (CVE-2025-32433) in an Erlang/OTP SSH server, crack extracted password hashes, and then harden the victim machine with firewall rules and patching.

CVE-2025-32433CRITICALsob ataque12 jun 2026

Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

100RISCO

abrir ↗

GitHub PoC

Lab + writeup for CVE-2026-44166: PocketBase OAuth2 account pre-hijacking via unvalidated createData.email

CVE-2026-44166MEDIUM11 jun 2026

Pocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade

33RISCO

abrir ↗

GitHub PoC

CVE-2026-45447 - Draft

CVE-2026-45447HIGH11 jun 2026

Heap Use-After-Free in the PKCS7_verify() Function

41RISCO

abrir ↗

GitHub PoC

Escáner pasivo de seguridad para CVE-2025-55182 que identifica indicadores públicos asociados a Next.js y React Server Components. Realiza validaciones seguras, analiza cabeceras y rutas, y proporciona una evaluación de exposición basada en evidencias sin explotación.

CVE-2025-55182CRITICALsob ataqueransomware11 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-23550CRITICAL11 jun 2026

WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability

68RISCO

abrir ↗

GitHub PoC★ 1

CVE-2026-11645

CVE-2026-11645HIGHsob ataque11 jun 2026

Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitra

71RISCO

abrir ↗

VulnCheck XDB

info-leak

CVE-2025-43529HIGHsob ataque11 jun 2026

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and

71RISCO

abrir ↗

GitHub PoC

CVE-2026-5027 - Draft

CVE-2026-5027HIGH11 jun 2026

Langflow - Path Traversal Arbitrary File Write via upload_user_file

68RISCO

abrir ↗

GitHub PoC

Cyber-DarkNay/CVE-2026-7458

CVE-2026-7458CRITICAL11 jun 2026

User Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint

48RISCO

abrir ↗

GitHub PoC★ 5

CVE-2026-36213 | Local Privilege Escalation in MEmu Android Emulator 9.2.7.0 via Insecure Service Binary Permissions | Patched in 9.3.2

CVE-2026-36213HIGH11 jun 2026

An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.e

41RISCO

abrir ↗

GitHub PoC

Cyber-DarkNay/CVE-2026-23550

CVE-2026-23550CRITICAL11 jun 2026

WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability

68RISCO

abrir ↗

GitHub PoC

This repository contains a lab validation report and detection artefacts for DirtyFrag CVE-2026-43284, a Linux local privilege escalation issue related to the XFRM/ESP page-cache write path. The focus is on auditd telemetry, event correlation, and SOC-oriented detection logic.

CVE-2026-43284HIGH11 jun 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RISCO

abrir ↗

GitHub PoC

Cyber-DarkNay/CVE-2025-6440

CVE-2025-6440CRITICAL11 jun 2026

WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload

60RISCO

abrir ↗

GitHub PoC★ 16

PoC for CVE-2026-48907 - Joomla! JCE extension < 2.9.99.5 unauthenticated RCE

CVE-2026-48907CRITICALsob ataque11 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISCO

abrir ↗

GitHub PoC

FangFang-Yi/CVE-2024-30088

CVE-2024-30088HIGHsob ataqueransomware11 jun 2026

Windows Kernel Elevation of Privilege Vulnerability

83RISCO

abrir ↗

GitHub PoC

CVE-2026-5027 - Draft

CVE-2026-5027HIGH11 jun 2026

Langflow - Path Traversal Arbitrary File Write via upload_user_file

68RISCO

abrir ↗

GitHub PoC

leehunkoo/cve-2013-4660_PoC

CVE-2013-4660—11 jun 2026

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

43RISCO

abrir ↗

GitHub PoC★ 2

CVE-2026-10795 – UpdraftPlus Authentication Bypass

CVE-2026-10795HIGH11 jun 2026

UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc

41RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.