Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
76.976exploits catalogados
35.273CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.445Referência 22.166GitHub PoC 14.070VulnCheck XDB 8.571Nuclei 4.251Metasploit 3.473✓ só verificadosrecentespopularesrisco
22.166 exploits
Referência
CVE-2026-15537
SourceCodester Online Book Store System login.php sql injection
33RISCO
abrir ↗Referência
CVE-2026-15536
itsourcecode Hospital Management System patviewprescription.php sql injection
33RISCO
abrir ↗Referência
CVE-2026-15532
SourceCodester Online Book Store System User Management cross site scripting
33RISCO
abrir ↗Referência
CVE-2026-15511
Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection
48RISCO
abrir ↗Referência
CVE-2026-15508
Helicone ai-gateway AWS Metadata Service service.rs build_target_url server-side request forgery
33RISCO
abrir ↗Referência
CVE-2020-11698
An issue was discovered in Titan SpamTitan 7.07. Improper input sanitization of the parameter community on the page snmp
60RISCO
abrir ↗Referência
CVE-2020-11978
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was disco
100RISCO
abrir ↗Referência
CVE-2026-59509
Unauthenticated arbitrary MongoDB collection read in cve-search
48RISCO
abrir ↗Referência
PandoraFMS 7.0 NG 746 - Persistent Cross-Site Scripting
Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator
28RISCO
abrir ↗Referência
Open-AudIT 3.3.0 - Reflective Cross-Site Scripting (Authenticated)
Open-AudIT 3.3.0 allows an XSS attack after login.
23RISCO
abrir ↗Referência
CVE-2026-13512
Databend Tenant client_session_manager.rs state_key authorization
33RISCO
abrir ↗Referência
RAD SecFlow-1v SF_0290_2.3.01.26 - Cross-Site Request Forgery (Reboot)
A vulnerability in the web-based management interface of RAD SecFlow-1v os-image SF_0290_2.3.01.26 could allow an unauth
23RISCO
abrir ↗Referência
CVE-2026-36908
A stack overflow in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of axiomatic-systems Bento4 before v1.8
33RISCO
abrir ↗Referência
CVE-2026-10753
Site Kit by Google < 1.176.0 - Editor+ Email Reporting Settings Update
28RISCO
abrir ↗Referência
CVE-2026-12673
Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability resulting in privilege escalati
33RISCO
abrir ↗Referência
CVE-2026-8935
Advanced Google Maps < 6.1.1 - Unauthenticated Administrator Account Creation
48RISCO
abrir ↗Referência
CVE-2026-8386
WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker ID
48RISCO
abrir ↗Referência
CVE-2026-8385
WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback
48RISCO
abrir ↗Referência
CVE-2026-12223
Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection
33RISCO
abrir ↗Referência
CVE-2026-12222
Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow
41RISCO
abrir ↗Referência
CVE-2026-12214
Qihoo 360 Total Security Nucleus Engine Monitoring Logic RpcStringBindingComposeW protection mechanism
41RISCO
abrir ↗Referência
CVE-2017-20251
WordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST API
48RISCO
abrir ↗Referência
CVE-2026-25856
OpenBullet2 0.3.2 Authenticated RCE via Job Configuration Interface
41RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.