Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
78.794exploits catalogados
36.057CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.459Referência 22.721GitHub PoC 14.946VulnCheck XDB 8.829Nuclei 4.350Metasploit 3.489✓ só verificadosrecentespopularesrisco
3.489 exploits
Metasploit600
Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload
Xerte Online Toolkits Path Disclosure via /setup
48RISCO
abrir ↗Metasploit600
Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload
Xerte Online Toolkits File Upload RCE via elfinder Connector
63RISCO
abrir ↗Metasploit600
Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload
Xerte Online Toolkits Path Traversal via connector.php
56RISCO
abrir ↗Metasploit600
Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload
Xerte Online Toolkits Missing Authentication via connector.php
56RISCO
abrir ↗Metasploit600
Flowise CSV Agent Prompt Injection RCE
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
43RISCO
abrir ↗Metasploit300
BerriAI LiteLLM Proxy Pre-Auth SQL Injection Scanner
LiteLLM: SQL injection in Proxy API key verification
100RISCO
abrir ↗Metasploit600
Paperclip AI RCE using a chain of six API calls (CVE-2026-41679).
Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
43RISCO
abrir ↗Metasploit600
Supsystic Contact Form Wordpress Plugin SSTI RCE
Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
75RISCO
abrir ↗Metasploit300
Citrix ADC (NetScaler) CVE-2026-3055 Scanner
Insufficient input validation leading to memory overread
95RISCO
abrir ↗Metasploit600
Langflow Unauth RCE
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RISCO
abrir ↗Metasploit600
Gogs Git Rebase Argument Injection RCE
Gogs: RCE via git rebase --exec argument injection in pull request merge
63RISCO
abrir ↗Metasploit600
WordPress Unauthenticated RCE via Pix for WooCommerce plugin
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
68RISCO
abrir ↗Metasploit600
AVideo Encoder getImage.php Unauthenticated Command Injection
AVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.php
43RISCO
abrir ↗Metasploit300
AVideo Unauthenticated SQL Injection Credential Dump
WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php
43RISCO
abrir ↗Metasploit600
Ghost CMS Remote Code Execution
Ghost Vulnerable to Remote Code Execution via Malicious Themes
36RISCO
abrir ↗Metasploit600
FreeScout Unauthenticated RCE via ZWSP .htaccess Bypass
FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache
36RISCO
abrir ↗Metasploit600
FreeScout Unauthenticated RCE via ZWSP .htaccess Bypass
FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution
55RISCO
abrir ↗Metasploit600
openDCIM install.php SQL Injection to RCE
openDCIM <= 23.04 SQL Injection in Config::UpdateParameter
43RISCO
abrir ↗Metasploit600
openDCIM install.php SQL Injection to RCE
openDCIM <= 23.04 Missing Authorization in install.php
63RISCO
abrir ↗Metasploit600
openDCIM install.php SQL Injection to RCE
openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter
63RISCO
abrir ↗Metasploit300
Cisco Catalyst SD-WAN Controller Authentication Bypass
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
100RISCO
abrir ↗Metasploit500
GrandStream GXP1600 Unauthenticated Remote Code Execution
Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow
75RISCO
abrir ↗Metasploit600
MajorDoMo Remote Command Injection via cycle_execs Race Condition
MajorDoMo Command Injection in rc/index.php via Race Condition
43RISCO
abrir ↗Metasploit600
MajorDoMo Console Eval Unauthenticated RCE
MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval
63RISCO
abrir ↗Metasploit600
MajorDoMo Supply Chain RCE via Update Poisoning
MajorDoMo Supply Chain Remote Code Execution via Update URL Poisoning
43RISCO
abrir ↗Metasploit600
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) unauthenticated Remote Code Execution
Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)
100RISCO
abrir ↗Metasploit600
Tactical RMM Jinja2 SSTI Remote Code Execution
A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactica
36RISCO
abrir ↗Metasploit600
Ivanti Endpoint Manager Mobile (EPMM) unauthenticated RCE
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.