Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

72.018exploits catalogados

32.219CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 20.023GitHub PoC 13.334VulnCheck XDB 8.195Nuclei 4.217Metasploit 3.463✓ só verificadosrecentes populares risco

72.018 exploits

GitHub PoC★ 1

Unauthenticated 0-click RCE exploit for CVE-2023-51409. Abuses an arbitrary file upload flaw in the AI Engine WordPress plugin to upload a PHP webshell and achieve remote command execution without authentication, including OS detection and an interactive shell.

CVE-2023-51409CRITICAL22 jan 2026

WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability

75RISCO

GitHub PoC★ 2

Unauthenticated 0-click RCE exploit for CVE-2024-9932. Exploits an arbitrary file upload vulnerability in the Wux Blog Editor WordPress plugin to upload a remote PHP payload, detect the target operating system, and achieve remote command execution through an interactive web shell.

CVE-2024-9932CRITICAL22 jan 2026

Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

60RISCO

GitHub PoC★ 1

Exploit for CVE-2023-40028 (for educational purposes)

CVE-2023-40028MEDIUM22 jan 2026

Arbitrary file read via symlinks in Ghost

45RISCO

GitHub PoC★ 1

A hands-on project demonstrating the setup of virtual security lab, network reconnaissance, and exploitation of CVE-2012-1823.

CVE-2012-1823CRITICALsob ataque22 jan 2026

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

100RISCO

GitHub PoC

Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation

CVE-2021-4034HIGHsob ataque22 jan 2026

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RISCO

GitHub PoC★ 1

Unauthenticated 0-click RCE exploit for CVE-2024-50498. Exploits a code injection vulnerability in the LUBUS WP Query Console plugin to execute arbitrary PHP code, write a web shell to the uploads directory, detect the target operating system, and achieve remote command execution via an interactive shell.

CVE-2024-50498CRITICAL22 jan 2026

WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerability

75RISCO

VulnCheck XDB

initial-access

CVE-2026-24061CRITICALsob ataque22 jan 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISCO

VulnCheck XDB

initial-access

CVE-2023-51409CRITICAL22 jan 2026

WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability

75RISCO

VulnCheck XDB

initial-access

CVE-2024-10924CRITICAL22 jan 2026

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

85RISCO

VulnCheck XDB

initial-access

CVE-2026-24061CRITICALsob ataque22 jan 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISCO

VulnCheck XDB

initial-access

CVE-2026-24061CRITICALsob ataque22 jan 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISCO

VulnCheck XDB

initial-access

CVE-2026-24061CRITICALsob ataque22 jan 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISCO

VulnCheck XDB

initial-access

CVE-2026-24061CRITICALsob ataque22 jan 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISCO

VulnCheck XDB

initial-access

CVE-2026-24061CRITICALsob ataque22 jan 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISCO

VulnCheck XDB

local

CVE-2023-52271MEDIUM21 jan 2026

The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any (Protected Process

33RISCO

VulnCheck XDB

initial-access

CVE-2021-36260CRITICALsob ataque21 jan 2026

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

100RISCO

GitHub PoC

React Router's createFileSessionStorage() in certain versions allows unsigned cookies to be manipulated, enabling file system access outside the session directory.

CVE-2025-61686CRITICAL21 jan 2026

React Router has Path Traversal in File Session Storage

53RISCO

VulnCheck XDB

initial-access

CVE-2019-10149CRITICALsob ataque21 jan 2026

A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message(

100RISCO

GitHub PoC

CybersRMUTL/CVE-2019-10149-Exim4-RCE

CVE-2019-10149CRITICALsob ataque21 jan 2026

A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message(

100RISCO

GitHub PoC★ 2

海康威视RCE漏洞批量检测和利用工具

CVE-2021-36260CRITICALsob ataque21 jan 2026

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

100RISCO

GitHub PoC★ 1

CVE-2017-7921, CVE-2021-36260 updated 21/01/2026

CVE-2021-36260CRITICALsob ataque21 jan 2026

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

100RISCO

GitHub PoC

MOVEit Transfer 2023 mass data breach (CVE-2023-34362)

CVE-2023-34362CRITICALsob ataqueransomware21 jan 2026

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.

100RISCO

GitHub PoC

nimesh895/Malware-Analysis-Follina-CVE-2022-30190

CVE-2022-30190HIGHsob ataqueransomware21 jan 2026

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

100RISCO

GitHub PoC★ 1

CVE-2017-7921, CVE-2021-36260 updated 21/01/2026

CVE-2017-7921CRITICALsob ataque21 jan 2026

An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16

100RISCO

GitHub PoC

abanop22333/Apache-Authentication-Flaw-Research-CVE-2024-38476-

CVE-2024-38476CRITICAL21 jan 2026

Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect

60RISCO

GitHub PoC★ 1

InfoSecAntara/CVE-2025-14847-MongoDB

CVE-2025-14847HIGHsob ataque21 jan 2026

Zlib compressed protocol header length confusion may allow memory read

100RISCO

GitHub PoC

afifudinmtop/CVE-2021-21425

CVE-2021-21425CRITICAL21 jan 2026

Unauthenticated Arbitrary YAML Write/Update leads to Code Execution

85RISCO

GitHub PoC★ 2

This Poc demonstrate Arbitrary read/write primitives provided by CVE-2025-7771

CVE-2025-7771HIGH21 jan 2026

Code Execution / Escalation of Privileges in ThrottleStop

41RISCO

GitHub PoC★ 1

Final Project in Fundamental network security,POC CVE-202438063

CVE-2024-38063CRITICAL21 jan 2026

Windows TCP/IP Remote Code Execution Vulnerability

70RISCO

GitHub PoC

CybersRMUTL/CVE-2019-9193-Postgresql-RCE

CVE-2019-9193—21 jan 2026

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve

60RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.