Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.886exploits catalogados

32.153CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 19.978GitHub PoC 13.282VulnCheck XDB 8.176Nuclei 4.202Metasploit 3.462✓ só verificadosrecentes populares risco

71.886 exploits

GitHub PoC

This repository provides production-ready detection engineering content for **CVE-2025-25257**, a pre-authentication SQL Injection vulnerability in Fortinet FortiWeb Fabric Connector versions 7.0 through 7.6.x. Successful exploitation can lead to Remote Code Execution without any prior authentication.

CVE-2025-25257CRITICALsob ataque01 mar 2026

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi

100RISCO

GitHub PoC

Black box penetration test — WordPress exploitation, privilege escalation via CVE-2022-0847

CVE-2022-0847HIGHsob ataque01 mar 2026

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RISCO

GitHub PoC

CVE-2022-22965

CVE-2022-22965CRITICALsob ataque01 mar 2026

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISCO

GitHub PoC

Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation

CVE-2021-4034HIGHsob ataque01 mar 2026

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RISCO

GitHub PoC

Controlled penetration testing lab demonstrating CVE-2011-2523 exploitation and mitigation techniques.

CVE-2011-2523—28 fev 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RISCO

GitHub PoC★ 1

Authenticated remote code execution in Pluck CMS before 4.7.13.

CVE-2020-29607—28 fev 2026

A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access

35RISCO

GitHub PoC

bcarrulo/Lab-CVE-2022-30190

CVE-2022-30190HIGHsob ataqueransomware28 fev 2026

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

100RISCO

GitHub PoC

GarethMSheldon/CVE-2025-60787-Detection-motionEye-RCE-via-Config-Injection

CVE-2025-60787HIGH28 fev 2026

MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name

61RISCO

GitHub PoC★ 2

Async RCE scanner for CVE-2025-55182 / CVE-2025-66478 — prototype-pollution → code execution via React Server Actions.

CVE-2025-55182CRITICALsob ataqueransomware28 fev 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

Metasploit600

openDCIM install.php SQL Injection to RCE

CVE-2026-28516CRITICAL28 fev 2026

openDCIM <= 23.04 SQL Injection in Config::UpdateParameter

43RISCO

Metasploit600

openDCIM install.php SQL Injection to RCE

CVE-2026-28515CRITICAL28 fev 2026

openDCIM <= 23.04 Missing Authorization in install.php

63RISCO

Metasploit600

openDCIM install.php SQL Injection to RCE

CVE-2026-28517CRITICAL28 fev 2026

openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter

63RISCO

GitHub PoC

CVE-2017-9805 S2-052 PoC

CVE-2017-9805HIGHsob ataque28 fev 2026

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with a

100RISCO

GitHub PoC

Public advisory and technical analysis for CVE-2026-36590, a NanoMQ v0.24.9 denial-of-service vulnerability.

CVE-2026-36590HIGH28 fev 2026

An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in

41RISCO

VulnCheck XDB

remote-with-credentials

CVE-2017-9805HIGHsob ataque28 fev 2026

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with a

100RISCO

GitHub PoC

Metasploit exploit for the CVE-2025-50286.

CVE-2025-50286HIGH28 fev 2026

A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plug

56RISCO

VulnCheck XDB

client-side

CVE-2022-30190HIGHsob ataqueransomware28 fev 2026

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

100RISCO

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALsob ataqueransomware28 fev 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

GitHub PoC

updated script

CVE-2019-9053—28 fev 2026

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RISCO

VulnCheck XDB

initial-access

CVE-2026-21902CRITICAL28 fev 2026

Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root

53RISCO

VulnCheck XDB

local

CVE-2024-21626HIGH28 fev 2026

runc container breakout through process.cwd trickery and leaked fds

61RISCO

VulnCheck XDB

info-leak

CVE-2026-1581HIGH27 fev 2026

wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection

56RISCO

VulnCheck XDB

local

CVE-2024-35250HIGHsob ataque27 fev 2026

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

91RISCO

GitHub PoC★ 7

CVE-2024-35250 demonstrates that HVCI is not a defense against data-only kernel exploits. As long as a driver bug provides an arbitrary R/W primitive, token swap remains a universal SYSTEM elevation technique — no code execution required.

CVE-2024-35250HIGHsob ataque27 fev 2026

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

91RISCO

VulnCheck XDB

initial-access

CVE-2022-42475CRITICALsob ataqueransomware27 fev 2026

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0

100RISCO

VulnCheck XDB

initial-access

CVE-2022-21445CRITICALsob ataque27 fev 2026

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF

90RISCO

GitHub PoC★ 5

Exploit for CVE-2022-21445 of Oracle Weblogic 12.2.1.X

CVE-2022-21445CRITICALsob ataque27 fev 2026

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF

90RISCO

GitHub PoC

ArthurHendrich/CVE-2022-42475-POC

CVE-2022-42475CRITICALsob ataqueransomware27 fev 2026

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0

100RISCO

GitHub PoC★ 2

CVE-2025-32433 PoC – SSH Protocol Python-based PoC for controlled lab testing of SSH message handling, channel operations, and pre-auth interactions. Designed for safe security research and analysis.

CVE-2025-32433CRITICALsob ataque26 fev 2026

Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

100RISCO

GitHub PoC★ 2

Python implementation of CVE-2023-43208 Mirth Connect RCE (Unauth XStream)

CVE-2023-43208CRITICALsob ataqueransomware26 fev 2026

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that

100RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.