Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

72.018exploits catalogados

32.219CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 20.023GitHub PoC 13.334VulnCheck XDB 8.195Nuclei 4.217Metasploit 3.463✓ só verificadosrecentes populares risco

13.334 exploits

GitHub PoC★ 1

This repository contains a proof-of-concept exploit for CVE-2025-48827, a critical authentication bypass vulnerability affecting vBulletin 5.0.0–5.7.5 and 6.0.0–6.0.3 when running on PHP 8.1 or later. The vulnerability allows unauthenticated attackers to invoke protected API methods remotely.

CVE-2025-48827CRITICAL14 jul 2025

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers'

85RISCO

GitHub PoC

Armand2002/Exploit-CVE-2025-1974-Lab

CVE-2025-1974CRITICAL14 jul 2025

ingress-nginx admission controller RCE escalation

85RISCO

GitHub PoC

CVE-2025-32023

CVE-2025-32023HIGH13 jul 2025

Redis allows out of bounds writes in hyperloglog commands leading to RCE

41RISCO

GitHub PoC★ 14

A detailed walkthrough of TryHackMe's Billing room exploiting CVE-2023-30258 and escalating via fail2ban misconfig

CVE-2023-30258CRITICAL13 jul 2025

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary com

85RISCO

GitHub PoC

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

CVE-2025-31125MEDIUMsob ataque13 jul 2025

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

90RISCO

GitHub PoC

This is a security assessment report regarding the EthernalBlue vulnerability (CVE-2017-0143).

CVE-2017-0143HIGHsob ataqueransomware13 jul 2025

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISCO

GitHub PoC★ 2

🚀 Exploit for Moodle 4.4.0 Authenticated RCE (CVE-2024-43425) — run commands remotely ⚡

CVE-2024-43425HIGH13 jul 2025

Moodle: remote code execution via calculated question types

78RISCO

GitHub PoC

CVE-2020-35848 impacts Cockpit-CMS v1.7 due to unsafe handling of user inputs in authentication mechanisms, leading to remote code execution. This lab is built for CTF players and bug bounty learners to simulate real-world exploitation workflows including token extraction, password reset, and flag capture.

CVE-2020-35848—13 jul 2025

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.

60RISCO

GitHub PoC★ 8

Wazuh 8.4 CVE-2025-24016

CVE-2025-24016CRITICALsob ataque13 jul 2025

Remote code execution in Wazuh server

100RISCO

GitHub PoC

JayVillain/Scan-CVE-2025-6058

CVE-2025-6058CRITICAL13 jul 2025

WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload

63RISCO

GitHub PoC

WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload

CVE-2025-6058CRITICAL12 jul 2025

WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload

63RISCO

GitHub PoC

r0otk3r/CVE-2024-1212

CVE-2024-1212CRITICALsob ataque12 jul 2025

LoadMaster Pre-Authenticated OS Command Injection

100RISCO

GitHub PoC★ 1

Python exploit for vsftpd 2.3.4 - Backdoor Command Execution

CVE-2011-2523—12 jul 2025

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RISCO

GitHub PoC★ 1

imbas007/CVE-2025-25257

CVE-2025-25257CRITICALsob ataque12 jul 2025

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi

100RISCO

GitHub PoC

Tool for detecting and exploiting CVE-2025-25257 in Fortinet FortiWeb.

CVE-2025-25257CRITICALsob ataque12 jul 2025

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi

100RISCO

GitHub PoC★ 1

Exploiting the CVE-2025-25257 vulnerability in FortiWeb. This repository demonstrates secure pre-authenticated SQL injection.

CVE-2025-25257CRITICALsob ataque12 jul 2025

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi

100RISCO

GitHub PoC

Proof of Concept for CVE-2025-24813, a Remote Code Execution vulnerability in Apache Tomcat. This PoC exploits unsafe deserialization via crafted session files uploaded through HTTP PUT requests, allowing attackers to execute arbitrary code remotely on vulnerable Tomcat servers.

CVE-2025-24813CRITICALsob ataque12 jul 2025

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RISCO

GitHub PoC

r0otk3r/CVE-2022-1388

CVE-2022-1388CRITICALsob ataqueransomware12 jul 2025

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RISCO

GitHub PoC

pkblanks/Remediating-CVE-2013-3900-EnableCertPaddingCheck-

CVE-2013-3900MEDIUMsob ataque12 jul 2025

WinVerifyTrust Signature Validation Vulnerability

75RISCO

GitHub PoC

MacUchegit/Detecting-and-Analyzing-CVE-2024-24919-Exploitation

CVE-2024-24919HIGHsob ataqueransomware12 jul 2025

Information disclosure

100RISCO

GitHub PoC★ 1

PoC dockerfile image for CVE-2025-48384

CVE-2025-48384HIGHsob ataque11 jul 2025

Git allows arbitrary code execution through broken config quoting

71RISCO

GitHub PoC

r0otk3r/CVE-2024-10915

CVE-2024-10915CRITICAL11 jul 2025

D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

85RISCO

GitHub PoC

Documentation for CVE-2025-6514. MCP-Remote RCE.

CVE-2025-6514CRITICAL11 jul 2025

OS command injection in mcp-remote when connecting to untrusted MCP servers

70RISCO

GitHub PoC

Delivering PHP RCE (CVE-2024-4577) to the Local Network Servers

CVE-2024-4577CRITICALsob ataqueransomware11 jul 2025

Argument Injection in PHP-CGI

100RISCO

GitHub PoC

Metasploit module for MailEnable CVE-2022-36934 authentication bypass RCE

CVE-2022-36934CRITICAL11 jul 2025

An integer overflow in WhatsApp could result in remote code execution in an established video call.

48RISCO

GitHub PoC

Rust PoC for CVE-2025-32463 (sudo chroot "chwoot" Local PrivEsc)

CVE-2025-32463CRITICALsob ataque11 jul 2025

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RISCO

GitHub PoC

hackmelocal/CVE-2025-49113-Simulation

CVE-2025-49113CRITICALsob ataque11 jul 2025

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the

100RISCO

GitHub PoC

just remeber how small mistake in santisize username could give yoy root access to the full machine

CVE-2007-2447—11 jul 2025

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands

50RISCO

GitHub PoC

Critical Sudo Vulnerabilities Let Local Users Gain Root Access on Linux, Impacting Major Distros

CVE-2025-32462LOW11 jul 2025

Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allo

28RISCO

GitHub PoC★ 6

CVE-2025-24201 WebKit Vulnerability Detector (PoC)

CVE-2025-24201CRITICALsob ataque11 jul 2025

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in

78RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.