Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
83.853exploits catalogados
39.383CVEs com exploração pública
24.695testados em laboratório
TodosReferência 25.447Exploit-DB 24.485GitHub PoC 16.269VulnCheck XDB 9.651Nuclei 4.478Metasploit 3.523✓ só verificadosrecentespopularesrisco
24.485 exploits
Exploit-DB
Krayin CRM 2.2.4 - IDOR
Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization
33RISCO
abrir ↗Exploit-DB
WordPress 7.0.2 - Path Travesal
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISCO
abrir ↗Exploit-DB
MikroTrick_ 7.24_ 7.24.2_ 7.0.0_ 7.23.4_ 6.0.0_ 6.49.21 - RCE
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
78RISCO
abrir ↗Exploit-DB
CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22_ 10.0 < 10.10_ 11.0 < 11.3 - RCE
ILIAS PHP Object Injection via Shibboleth Logout
48RISCO
abrir ↗Exploit-DB
FreePBX 17.0.2 - Remote Code Execution (RCE)
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RISCO
abrir ↗Exploit-DB
Metabase 0.61.0 - Authenticated Remote Code Execution
Metabase: Unsafe Deserialization of H2 Query Results
48RISCO
abrir ↗Exploit-DB
Bludit CMS 3.20.0 - Reflected Cross-Site Scripting
Bludit CMS Reflected XSS via Search Plugin
48RISCO
abrir ↗Exploit-DB
PodcastGenerator 3.2.9 - Stored XSS
A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote atta
33RISCO
abrir ↗Exploit-DB
Langflow 1.10.0 - RCE
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
98RISCO
abrir ↗Exploit-DB
Ghost_CMS 6.19.0 - Remote Code Execution
Ghost Vulnerable to Remote Code Execution via Malicious Themes
56RISCO
abrir ↗Exploit-DB
Marimo 0.20.4 - RCE
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISCO
abrir ↗Exploit-DB
EVerest 2025.9.0 - DoS
EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop
41RISCO
abrir ↗Exploit-DB
Payload CMS 3.72.0 - Blind SQL Injection
Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
48RISCO
abrir ↗Exploit-DB
Wolf CMS 0.8.3.1 - RCE v
Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload
41RISCO
abrir ↗Exploit-DB
EasyAppointments 1.5.1 - Blind SQL Injection
SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAp
48RISCO
abrir ↗Exploit-DB
miniOrange 5.4.3 - Unauthenticated Auth Bypass
SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion
48RISCO
abrir ↗Exploit-DB
Grav CMS 2.0.7 - RCE
Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData
48RISCO
abrir ↗Exploit-DB
C-MOR 6.0104 - Cross-Site Scripting (XSS)
Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to e
33RISCO
abrir ↗Exploit-DB
C-MOR 6.0104 - Directory Traversal
The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' paramete
41RISCO
abrir ↗Exploit-DB
Langflow 1.8.4 - Path Traversal to Remote Code Execution
Langflow - Path Traversal Arbitrary File Write via upload_user_file
56RISCO
abrir ↗Exploit-DB
CubeCart 6.7.4 - SQL
CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
41RISCO
abrir ↗Exploit-DB
CubeCart 6.7.4 - SQL injection
CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php
41RISCO
abrir ↗Exploit-DB
Linksys E1200_2.0.04 - Unauthenticated OS Command Injection
An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200
38RISCO
abrir ↗Exploit-DB
CubeCart 6.7.4 - Stored XSS
CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass
33RISCO
abrir ↗Exploit-DB
CubeCart 6.7.4 - Cross-Site Scripting
CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System
33RISCO
abrir ↗Exploit-DB
CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE
mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where th
56RISCO
abrir ↗Exploit-DB
WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
68RISCO
abrir ↗Exploit-DB
NanaZip 6.5 - DoS
NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size
28RISCO
abrir ↗Exploit-DB
D-Link DNS_340L - OS Command Injection
D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
85RISCO
abrir ↗página 1 / 817próximo →
Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.