Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
79.305exploits catalogados
36.465CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.466Referência 23.051GitHub PoC 15.051VulnCheck XDB 8.883Nuclei 4.361Metasploit 3.493✓ só verificadosrecentespopularesrisco
24.466 exploits
Exploit-DB
Metabase 0.61.0 - Authenticated Remote Code Execution
Metabase: Unsafe Deserialization of H2 Query Results
48RISCO
abrir ↗Exploit-DB
Langflow 1.10.0 - RCE
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
100RISCO
abrir ↗Exploit-DB
Grav CMS 2.0.7 - RCE
Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData
48RISCO
abrir ↗Exploit-DB
EasyAppointments 1.5.1 - Blind SQL Injection
SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAp
48RISCO
abrir ↗Exploit-DB
Wolf CMS 0.8.3.1 - RCE v
Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload
41RISCO
abrir ↗Exploit-DB
miniOrange 5.4.3 - Unauthenticated Auth Bypass
SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion
48RISCO
abrir ↗Exploit-DB
CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE
mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where th
56RISCO
abrir ↗Exploit-DB
Joomla JCE_2.9.15 - Remote Code Execution
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISCO
abrir ↗Exploit-DB
webpack_devserver 5.2.5 - CSRF
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
33RISCO
abrir ↗Exploit-DB
NanaZip 6.5 - DoS
NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size
28RISCO
abrir ↗Exploit-DB
Nmap 7.99 - Extension Header Integer Underflow
Nmap - Integer Underflow in IPv6 Extension Header Parsing
33RISCO
abrir ↗Exploit-DB
WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
68RISCO
abrir ↗Exploit-DB
D-Link DNS_340L - OS Command Injection
D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
85RISCO
abrir ↗Exploit-DB
phpSysInfo 3.4.5 - IP Allowlist Bypass
phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
41RISCO
abrir ↗Exploit-DB
Blocksy Companion 2.1.46 - RCE
Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments
48RISCO
abrir ↗Exploit-DB
mcp-server-kubernetes 3.8.x - Argument Injection
MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools
48RISCO
abrir ↗Exploit-DB
Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF
Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter
61RISCO
abrir ↗Exploit-DB
PraisonAI praisonaiagents 1.6.77 - Remote Code Execution
PraisonAI before 1.6.78 Remote Code Execution via CodeAgent
48RISCO
abrir ↗Exploit-DB
LuCI DHCPv6 - Lease Hostname Stored Cross-Site Scripting
LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting
48RISCO
abrir ↗Exploit-DB
Joomla 2.9.99.4 - Unauthenticated Remote Code Execution
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISCO
abrir ↗Exploit-DB
Microsoft Edge 150.0.4078.48 - RCE
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
48RISCO
abrir ↗Exploit-DB
OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution
Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
63RISCO
abrir ↗Exploit-DB
Atarim WordPress Plugin 4.2.2 - Sensitive Information Exposure
WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability
56RISCO
abrir ↗Exploit-DB
Langflow 1.9.0 - RCE
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RISCO
abrir ↗Exploit-DB
Joomla Page Builder CK 3.5.10 - Arbitrary File Upload
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0
75RISCO
abrir ↗Exploit-DB
Krayin CRM v2.2.x - Authenticated Remote Code Execution
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a
48RISCO
abrir ↗Exploit-DB
Hydra - Stack Buffer Overflow
Hydra - Stack Buffer Overflow in NTLM Authentication Handler
41RISCO
abrir ↗Exploit-DB
Discuz! X5.0 - Authentication Bypass
Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle
63RISCO
abrir ↗Exploit-DB
Flowise 3.1.3 - arbitrary code execution
Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity
28RISCO
abrir ↗página 1 / 816próximo →
Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.