Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

75.445exploits catalogados

34.432CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.443Referência 21.497GitHub PoC 13.627VulnCheck XDB 8.198Nuclei 4.217Metasploit 3.463✓ só verificadosrecentes populares risco

13.627 exploits

GitHub PoC★ 1

Partners <= 0.2.0 - Unauthenticated PHP Object Injection

CVE-2024-56059CRITICAL13 jan 2025

WordPress Partners plugin <= 0.2.0 - PHP Object Injection vulnerability

48RISCO

abrir ↗

GitHub PoC★ 1

VRPConnector <= 2.0.1 - Unauthenticated PHP Object Injection

CVE-2024-56058CRITICAL13 jan 2025

WordPress VRPConnector plugin <= 2.0.1 - PHP Object Injection vulnerability

48RISCO

abrir ↗

GitHub PoC★ 2

kcfg bypass example - CVE-2024-21338

CVE-2024-21338HIGHsob ataqueransomware12 jan 2025

Windows Kernel Elevation of Privilege Vulnerability

83RISCO

abrir ↗

GitHub PoC

Nxploited/CVE-2024-10586-Poc

CVE-2024-10586CRITICAL12 jan 2025

Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creation

48RISCO

abrir ↗

GitHub PoC★ 1

RSVP ME <= 1.9.9 - Unauthenticated SQL Injection

CVE-2024-50491CRITICAL12 jan 2025

WordPress RSVP ME plugin <= 1.9.9 - SQL Injection vulnerability

48RISCO

abrir ↗

GitHub PoC★ 4

# CVE-2025-0282: Remote Code Execution Vulnerability in [StorkS]

CVE-2025-0282CRITICALsob ataqueransomware12 jan 2025

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7

100RISCO

abrir ↗

GitHub PoC

he Hunk Companion Plugin for WordPress: Vulnerable to Unauthorized Plugin Installation/Activation (Versions Up to and Including 1.8.4)

CVE-2024-9707CRITICAL12 jan 2025

Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation

63RISCO

abrir ↗

GitHub PoC★ 1

WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection

CVE-2024-3605CRITICAL12 jan 2025

WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection

63RISCO

abrir ↗

GitHub PoC★ 17

CVE-2024-50603: Aviatrix Controller Unauthenticated Command Injection

CVE-2024-50603CRITICALsob ataque12 jan 2025

An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutraliza

100RISCO

abrir ↗

GitHub PoC★ 1

Subscribe to Category <= 2.7.4 - Unauthenticated SQL Injection

CVE-2023-32590CRITICAL12 jan 2025

WordPress Subscribe to Category Plugin <= 2.7.4 is vulnerable to SQL Injection

63RISCO

abrir ↗

GitHub PoC★ 1

GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection

CVE-2024-12877CRITICAL11 jan 2025

GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection

48RISCO

abrir ↗

GitHub PoC

A Python script to detect CVE-2024-41713, a directory traversal vulnerability in Apache HTTP Server, enabling unauthorized access to restricted resources. This tool is for educational purposes and authorized testing only. Unauthorized usage is unethical and illegal.

CVE-2024-41713CRITICALsob ataqueransomware11 jan 2025

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could

100RISCO

abrir ↗

GitHub PoC

poc-cve-2023-3824

CVE-2023-3824CRITICAL11 jan 2025

Buffer overflow and overread in phar_dir_read()

48RISCO

abrir ↗

GitHub PoC

Exploit implementation for CVE-2021-21551

CVE-2021-21551HIGHsob ataque11 jan 2025

Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile

98RISCO

abrir ↗

GitHub PoC★ 1

Bludit 3.9.2 - Auth Bruteforce Bypass CVE:2019-17240 Refurbish In bash

CVE-2019-17240LOW11 jan 2025

bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many

40RISCO

abrir ↗

GitHub PoC

Nxploited/CVE-2024-49328-exploit

CVE-2024-49328CRITICAL11 jan 2025

WordPress WP REST API FNS Plugin plugin <= 1.0.0 - Account Takeover vulnerability

48RISCO

abrir ↗

GitHub PoC★ 53

CVE-2025-0282 is a critical vulnerability found in Ivanti Connect Secure, allowing Remote Command Execution (RCE) through a buffer overflow exploit.

CVE-2025-0282CRITICALsob ataqueransomware11 jan 2025

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7

100RISCO

abrir ↗

GitHub PoC

Nxploited/CVE-2024-9932-POC

CVE-2024-9932CRITICAL11 jan 2025

Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

60RISCO

abrir ↗

GitHub PoC

XSS Test Swagger 3.14.1 to 3.37.0

CVE-2025-8191MEDIUM10 jan 2025

macrozheng mall Swagger UI index.html cross site scripting

33RISCO

abrir ↗

GitHub PoC★ 3

Vulnerable Environment and Exploit for CVE-2024-53677

CVE-2024-53677CRITICAL10 jan 2025

Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

70RISCO

abrir ↗

GitHub PoC★ 2

Exploit For: CVE-2024-36840: SQL Injection Vulnerability in Boelter Blue System Management (Version 1.3)

CVE-2024-36840CRITICAL10 jan 2025

SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code a

48RISCO

abrir ↗

GitHub PoC

The **Dirty Pipe exploit (CVE-2022-0847)** is a Linux kernel vulnerability (v5.8+) allowing unprivileged attackers to overwrite arbitrary files via a flaw in the pipe mechanism. This leads to privilege escalation, granting root access. Similar to Dirty Cow but easier to exploit. Fix: Update to a patched kernel version.

CVE-2022-0847HIGHsob ataque08 jan 2025

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RISCO

abrir ↗

GitHub PoC★ 5

Fuel CMS 1.4.1 - Remote Code Execution

CVE-2018-16763—08 jan 2025

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca

60RISCO

abrir ↗

GitHub PoC★ 12

CVE-2024-49112 LDAP RCE PoC and Metasploit Module

CVE-2024-49112CRITICAL08 jan 2025

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

70RISCO

abrir ↗

GitHub PoC★ 1

punitdarji/Apache-struts-cve-2024-53677

CVE-2024-53677CRITICAL08 jan 2025

Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

70RISCO

abrir ↗

GitHub PoC

Taldrid1/cve-2021-41773

CVE-2021-41773HIGHsob ataqueransomware07 jan 2025

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

abrir ↗

GitHub PoC★ 121

GeoServer（CVE-2024-36401/CVE-2024-36404）漏洞利用工具

CVE-2024-36401CRITICALsob ataque07 jan 2025

Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

100RISCO

abrir ↗

GitHub PoC

JustinYe377/CTF-CVE-2022-0847

CVE-2022-0847HIGHsob ataque07 jan 2025

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RISCO

abrir ↗

GitHub PoC★ 3

An rewritten POC on the CVE-2014-3704

CVE-2014-3704—06 jan 2025

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct

60RISCO

abrir ↗

GitHub PoC★ 6

CRUNZEX/CVE-2025-22968

CVE-2025-22968CRITICAL05 jan 2025

An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account witho

48RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.