Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

80.184exploits catalogados

37.029CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.476Referência 23.521GitHub PoC 15.321VulnCheck XDB 8.970Nuclei 4.394Metasploit 3.502✓ só verificadosrecentes populares risco

15.321 exploits

GitHub PoC★ 3

CVE-2025-64446 - A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

CVE-2025-64446CRITICALsob ataque17 nov 2025

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RISCO

GitHub PoC

letsr00t/CVE-2019-13272

CVE-2019-13272HIGHsob ataque17 nov 2025

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proce

98RISCO

GitHub PoC

D-link AX1500 Vulnerability

CVE-2025-60854CRITICAL16 nov 2025

A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter during

48RISCO

GitHub PoC

This repository contains my work for a cybersecurity assignment where I exploited the real-world Log4Shell (CVE-2021-44228) vulnerability inside a safe, controlled virtual machine. The project followed a Capture-the-Flag format with multiple exploitation tasks to retrieve hidden flags.

CVE-2021-44228CRITICALsob ataqueransomware16 nov 2025

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

GitHub PoC

placeholder for CitrixBleed 2.0 CVE-2025-5777

CVE-2025-5777CRITICALsob ataqueransomware16 nov 2025

NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

100RISCO

GitHub PoC

Practical security research project exploiting CVE-2025-32463 to gain root access on a vulnerable sudo version. Includes write-up, PoC, and mitigation steps.

CVE-2025-32463CRITICALsob ataque16 nov 2025

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RISCO

GitHub PoC★ 13

Unauthenticated RCE PoC in Microsoft Windows Server Update Service (WSUS) - CVE-2025-59287 & CVE-2023-35317

CVE-2025-59287CRITICALsob ataque16 nov 2025

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

100RISCO

GitHub PoC

honeyvig/CVE-2022-0847-DirtyPipe-Exploit

CVE-2022-0847HIGHsob ataque16 nov 2025

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RISCO

GitHub PoC★ 1

CMS Made Simple < 2.2.10 - SQL Injection . Actual working version

CVE-2019-9053—16 nov 2025

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RISCO

GitHub PoC

Detection, Exploit and Mitigation for CVE 2023 46604.

CVE-2023-46604CRITICALsob ataqueransomware15 nov 2025

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

100RISCO

GitHub PoC★ 1

CVE-2025-64328 FreePBX Authenticated Command Injection in the framework module.

CVE-2025-64328HIGHsob ataque15 nov 2025

FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

100RISCO

GitHub PoC★ 2

Python3-converted exploit and research notes for CMS Made Simple (CVE-2019-9053) — Unauthenticated SQL Injection vulnerability. Includes original PoC, improved Python3 version, usage instructions, and lab testing reference.

CVE-2019-9053—15 nov 2025

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RISCO

GitHub PoC★ 1

Twodimensionalitylevelcrossing817/CVE-2025-59287

CVE-2025-59287CRITICALsob ataque15 nov 2025

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

100RISCO

GitHub PoC★ 13

soltanali0/CVE-2025-64446-Exploit

CVE-2025-64446CRITICALsob ataque15 nov 2025

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RISCO

GitHub PoC★ 1

PoC for CVE-2025-64513 — Milvus Proxy Authentication Bypass Vulnerability Batch scanner to verify unauthorized access and gather Milvus version, health, and database info. For security research and defensive validation only.

CVE-2025-64513CRITICAL14 nov 2025

Milvus Proxy has Critical Authentication Bypass Vulnerability

48RISCO

GitHub PoC★ 67

Universal exploitation tool for CVE-2025-33073 targeting Windows Domain Controllers with DNSAdmins privileges and WinRM enabled.

CVE-2025-33073HIGHsob ataque14 nov 2025

Windows SMB Client Elevation of Privilege Vulnerability

93RISCO

GitHub PoC★ 7

PoC de CVE-2025-64446: path traversal a RCE en Fortinet FortiWeb. Solo uso educativo.

CVE-2025-64446CRITICALsob ataque14 nov 2025

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RISCO

GitHub PoC★ 13

sxyrxyy/CVE-2025-64446-FortiWeb-CGI-Bypass-PoC

CVE-2025-64446CRITICALsob ataque14 nov 2025

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RISCO

GitHub PoC★ 32

CVE-2025-62215 is an Elevation of Privilege (EoP) vulnerability in the Windows Kernel, disclosed in November 2025 and confirmed to be actively exploited as a zero-day.

CVE-2025-62215HIGHsob ataque14 nov 2025

Windows Kernel Elevation of Privilege Vulnerability

71RISCO

GitHub PoC

CVE-2022-22965 proof of concept for CS4239 report

CVE-2022-22965CRITICALsob ataque14 nov 2025

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISCO

GitHub PoC★ 67

Universal exploitation tool for CVE-2025-33073 targeting Windows Domain Controllers with DNSAdmins privileges and WinRM enabled.

CVE-2025-33073HIGHsob ataque14 nov 2025

Windows SMB Client Elevation of Privilege Vulnerability

93RISCO

GitHub PoC

keyuraghao/CVE-2025-20260

CVE-2025-20260CRITICAL13 nov 2025

ClamAV PDF Scanning Buffer Overflow Vulnerability

48RISCO

GitHub PoC

cyhe50/cve-2025-32434-poc

CVE-2025-32434CRITICAL13 nov 2025

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

48RISCO

GitHub PoC★ 7

PoC Exploit CVE-2018-6389

CVE-2018-6389—13 nov 2025

In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the

45RISCO

GitHub PoC★ 15

Arbitrary physical memory read/write exploitation using ThrottleStop.sys (CVE-2025-7771) with superfetch address translation - Windows kernel security research

CVE-2025-7771HIGH13 nov 2025

Code Execution / Escalation of Privileges in ThrottleStop

41RISCO

GitHub PoC

Alex-Acero-Security/CVE-2024-48910-POC

CVE-2024-48910CRITICAL12 nov 2025

DOMPurify vulnerable to tampering by prototype polution

48RISCO

GitHub PoC★ 24

redpack-kr/CVE-2025-60710

CVE-2025-60710HIGHsob ataqueransomware12 nov 2025

Host Process for Windows Tasks Elevation of Privilege Vulnerability

71RISCO

GitHub PoC

Exploit cyberpanel version 2.3.6 - 2.3.7

CVE-2024-51378CRITICALsob ataqueransomware11 nov 2025

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers t

100RISCO

GitHub PoC

harekrishnarai/CVE-2024-23897-test-windows

CVE-2024-23897CRITICALsob ataqueransomware11 nov 2025

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RISCO

GitHub PoC

Detection for CVE-2025-34299

CVE-2025-34299CRITICAL11 nov 2025

Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload

85RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.