Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.886exploits catalogados

32.153CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 19.978GitHub PoC 13.282VulnCheck XDB 8.176Nuclei 4.202Metasploit 3.462✓ só verificadosrecentes populares risco

13.282 exploits

GitHub PoC★ 92

React2Shell Proof of Concept

CVE-2025-55182CRITICALsob ataqueransomware04 dez 2025

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

GitHub PoC★ 4

xkillbit/cve-2025-55182-scanner

CVE-2025-55182CRITICALsob ataqueransomware04 dez 2025

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

GitHub PoC★ 1

A proof of concept of remote code execution

CVE-2025-48384HIGHsob ataque04 dez 2025

Git allows arbitrary code execution through broken config quoting

71RISCO

abrir ↗

GitHub PoC★ 1

zr0n/CVE-2025-48384-sub

CVE-2025-48384HIGHsob ataque04 dez 2025

Git allows arbitrary code execution through broken config quoting

71RISCO

abrir ↗

GitHub PoC

Wercd/CVE-2021-26855

CVE-2021-26855CRITICALsob ataqueransomware04 dez 2025

Microsoft Exchange Server Remote Code Execution Vulnerability

100RISCO

abrir ↗

GitHub PoC

Docker test environment for CVE-2025-13486 (ACF Extended RCE). For security research only.

CVE-2025-13486CRITICAL04 dez 2025

Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form

85RISCO

abrir ↗

GitHub PoC★ 5

POC for CVE-2025-13486

CVE-2025-13486CRITICAL04 dez 2025

Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form

85RISCO

abrir ↗

GitHub PoC

Vulnerable setup for CVE-2025-13486 - Advanced Custom Fields: Extended - Remote Code Execution

CVE-2025-13486CRITICAL04 dez 2025

Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form

85RISCO

abrir ↗

GitHub PoC

Untested completition of the Redishell PoC made by AI

CVE-2025-49844CRITICAL03 dez 2025

Redis Lua Use-After-Free may lead to remote code execution

85RISCO

abrir ↗

GitHub PoC

0xDTC/XWiki-Platform-RCE-CVE-2025-24893

CVE-2025-24893CRITICALsob ataque03 dez 2025

Remote code execution as guest via SolrSearchMacros request in xwiki

100RISCO

abrir ↗

GitHub PoC

Exploit and test stand for CVE-2025-41115

CVE-2025-41115CRITICAL03 dez 2025

Incorrect privilege assignment

53RISCO

abrir ↗

GitHub PoC★ 14

CVE-2025-55182 - React Server Components RCE Exploit & Scanner Supports external servers and CLI interface

CVE-2025-55182CRITICALsob ataqueransomware03 dez 2025

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

GitHub PoC★ 113

A non-intrusive surface scanner for CVE-2025-55182 (React Server Components RCE). Detects exposed RSC endpoints in React 19 and Next.js applications

CVE-2025-55182CRITICALsob ataqueransomware03 dez 2025

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

GitHub PoC

CVE-2025-55182 - React Server Components RCE Exploit & Scanner Supports external servers and CLI interface

CVE-2025-55182CRITICALsob ataqueransomware03 dez 2025

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

GitHub PoC★ 798

CVE-2025-55182 POC

CVE-2025-55182CRITICALsob ataqueransomware03 dez 2025

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

GitHub PoC

DaniilOrchikov/PIL-CVE-2017-8291

CVE-2017-8291HIGHsob ataque03 dez 2025

Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion

100RISCO

abrir ↗

GitHub PoC★ 12

Script to quick check CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) - Critical unauthenticated RCE vulnerabilities in the React Server Components (RSC) “Flight” protocol.

CVE-2025-55182CRITICALsob ataqueransomware03 dez 2025

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

GitHub PoC★ 4

#F5-BIG-IP-CVE-2023-46747-Exploit – Unauthenticated RCE Python exploit & Nuclei template by Raguraman ✓ Automated TCP reverse shell (LHOST/LPORT) ✓ Tested on affected BIG-IP 13.x–17.x ⚠️ Authorized pentesting only

CVE-2023-46747CRITICALsob ataqueransomware03 dez 2025

BIG-IP Configuration utility unauthenticated remote code execution vulnerability

100RISCO

abrir ↗

GitHub PoC★ 4

santihabib/CVE-2025-55182-analysis

CVE-2025-55182CRITICALsob ataqueransomware03 dez 2025

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

GitHub PoC

This repo contain a PoC I have done when blind analysis the dbutil_2_3.sys driver for vulnerability. This was created by personal analysis without looking at writeups or even know which CVE exist in this driver. All the knowledge I have is that this driver is vulnerable in some way.

CVE-2021-21551HIGHsob ataque02 dez 2025

Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile

98RISCO

abrir ↗

GitHub PoC

boro03/CVE-2021-4034

CVE-2021-4034HIGHsob ataque02 dez 2025

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RISCO

abrir ↗

GitHub PoC★ 1

PoC for testing CVE-2025-29927 for Next.js versions 11.x, 12.x <= 12.3.5, 13.x <= 13.5.9, 14.x <=14.2.25, 15.x <= 15.2.3

CVE-2025-29927CRITICAL02 dez 2025

Authorization Bypass in Next.js Middleware

85RISCO

abrir ↗

GitHub PoC★ 1

Jorge2Rubio/CVE-2019-0232

CVE-2019-0232—02 dez 2025

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0

60RISCO

abrir ↗

GitHub PoC

sudlit/CVE-2017-7494

CVE-2017-7494CRITICALsob ataqueransomware02 dez 2025

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo

100RISCO

abrir ↗

GitHub PoC

Vulnerable environment for testing CVE-2021-22941 Nuclei template

CVE-2021-22941CRITICALsob ataqueransomware02 dez 2025

Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacke

90RISCO

abrir ↗

GitHub PoC

towaos/towaos-lab-cve-2020-11023

CVE-2020-11023MEDIUMsob ataque02 dez 2025

Potential XSS vulnerability in jQuery

85RISCO

abrir ↗

GitHub PoC★ 2

Vulnerability: SQL Injection via QuerySet and Q() keyword argument unpacking. CVE ID: CVE-2025-64459 Severity: Critical (CVSS 9.1) Affected Versions: Django 5.1 < 5.1.14, 4.2 < 4.2.26, and 5.2 < 5.2.8. Researcher: Cyberstan (University of Warwick)

CVE-2025-64459CRITICAL01 dez 2025

Potential SQL injection via _connector keyword argument in QuerySet and Q objects

53RISCO

abrir ↗

GitHub PoC

letsr00t/CVE-2013-2094

CVE-2013-2094HIGHsob ataque01 dez 2025

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data t

83RISCO

abrir ↗

GitHub PoC★ 8

Reverse engineering research and custom firmware for the Allwinner V3-based SJCAM SJ4000 Air, including firmware parsers, an AVIOCTRL client, security research, and the CVE-2026-52656 proof of concept.

CVE-2026-52656CRITICAL01 dez 2025

An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an a

48RISCO

abrir ↗

GitHub PoC★ 11

Outlook exploitation

CVE-2024-21413CRITICALsob ataque30 nov 2025

Microsoft Outlook Remote Code Execution Vulnerability

100RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.