Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
88.056exploits catalogados
40.804CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4.578Metasploit 3.539✓ só verificadosrecentespopularesrisco
87.948 exploits
GitHub PoC
Vulhub grafana/CVE-2021-43798: Grafana Plugin Path Traversal (CVE-2021-43798), run with Isoloom
Grafana path traversal
100RISCO
abrir ↗GitHub PoC
Vulhub saltstack/CVE-2020-11651: SaltStack Master Authentication Bypass (CVE-2020-11651), run with Isoloom
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs cla
100RISCO
abrir ↗GitHub PoC
Vulhub couchdb/CVE-2017-12635: Apache CouchDB Privilege Escalation (CVE-2017-12635), run with Isoloom
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB be
60RISCO
abrir ↗GitHub PoC
Vulhub gitlab/CVE-2021-22205: GitLab CE 13.10.1 ExifTool unauthenticated RCE, run with Isoloom
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validati
100RISCO
abrir ↗VulnCheck XDB
initial-access
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISCO
abrir ↗GitHub PoC
Vulhub weblogic/CVE-2017-10271: WebLogic wls-wsat XMLDecoder RCE, run with Isoloom
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RISCO
abrir ↗GitHub PoC
Vulhub spring/CVE-2022-22947: Spring Cloud Gateway Actuator Code Injection (CVE-2022-22947), run with Isoloom
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISCO
abrir ↗GitHub PoC
Vulhub phpunit/CVE-2017-9841: PHPUnit eval-stdin.php RCE (CVE-2017-9841), run with Isoloom
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
100RISCO
abrir ↗GitHub PoC
Vulhub imagemagick/CVE-2016-3714: ImageTragick on a PHP upload page, run with Isoloom
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
100RISCO
abrir ↗GitHub PoC
Vulhub mysql/CVE-2012-2122: MySQL Authentication Bypass (CVE-2012-2122), run with Isoloom
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor
60RISCO
abrir ↗GitHub PoC
Vulhub supervisor/CVE-2017-11610: Supervisord XML-RPC RCE (CVE-2017-11610), run with Isoloom
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows rem
60RISCO
abrir ↗GitHub PoC
Vulhub joomla/CVE-2023-23752: Joomla Webservice Improper Access Check (CVE-2023-23752), run with Isoloom
[20230201] - Core - Improper access check in webservice endpoints
100RISCO
abrir ↗GitHub PoC
Vulhub jenkins/CVE-2024-23897: Jenkins CLI Arbitrary File Read (CVE-2024-23897), run with Isoloom
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an
100RISCO
abrir ↗GitHub PoC
CVE-2026-92555 Exploit
Database Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel
48RISCO
abrir ↗GitHub PoC
Vulhub opensmtpd/CVE-2020-7247: OpenSMTPD MAIL FROM Command Injection (CVE-2020-7247), run with Isoloom
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to
100RISCO
abrir ↗GitHub PoC
Vulhub shiro/CVE-2016-4437: Shiro 1.2.4 rememberMe deserialization, run with Isoloom
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attack
100RISCO
abrir ↗GitHub PoC
Vulhub tomcat/CVE-2020-1938: Apache Tomcat AJP Ghostcat (CVE-2020-1938), run with Isoloom
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc
100RISCO
abrir ↗GitHub PoC
Vulhub weblogic/CVE-2020-14882: Oracle WebLogic Console Pre-Auth RCE (CVE-2020-14882, CVE-2020-14883), run with Isoloom
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISCO
abrir ↗GitHub PoC
Atlassian Data Center Multiple Products - Arbitrary File Access (Path Traversal)
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RISCO
abrir ↗GitHub PoC★ 1
Laboratory proof of concept and research notes for CVE-2026-67279 on MikroTik RouterOS 6.42.
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
63RISCO
abrir ↗GitHub PoC
CVE-2026-91940: arbitrary file write in crawl4ai <=0.9.2 via the untrusted-config gate (PDFContentScrapingStrategy image_save_dir). Analysis, reproduction harness and verified 0.9.2 vs 0.9.3 boundary.
crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy
41RISCO
abrir ↗GitHub PoC★ 1
a challenge for a CVE-2026-49881
In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the
41RISCO
abrir ↗GitHub PoC
Vulhub laravel/CVE-2021-3129: Laravel Ignition RCE (CVE-2021-3129), run with Isoloom
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra
100RISCO
abrir ↗GitHub PoC
Vulhub activemq/CVE-2016-3088: ActiveMQ Fileserver Arbitrary File Write (CVE-2016-3088), run with Isoloom
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitr
100RISCO
abrir ↗VulnCheck XDB
initial-access
Improper Certificate Validation in Quantum Security Gateway
90RISCO
abrir ↗VulnCheck XDB
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
abrir ↗VulnCheck XDB
initial-access
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1
98RISCO
abrir ↗VulnCheck XDB
initial-access
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISCO
abrir ↗VulnCheck XDB
initial-access
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.