Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

75.445exploits catalogados

34.432CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.443Referência 21.497GitHub PoC 13.627VulnCheck XDB 8.198Nuclei 4.217Metasploit 3.463✓ só verificadosrecentes populares risco

13.627 exploits

GitHub PoC

Modified version of laravel ignition RCE (CVE-2021-3129) exploit script for Hour of Hack Session-4

CVE-2021-3129CRITICALsob ataqueransomware04 dez 2024

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra

100RISCO

abrir ↗

GitHub PoC

A utility for Magento 2 encryption key rotation and management. CVE-2024-34102(aka Cosmic Sting) victims can use it as an aftercare.

CVE-2024-34102CRITICALsob ataque04 dez 2024

XXE can expose crypt key and other secrets granting full admin access

100RISCO

abrir ↗

GitHub PoC★ 1

This is a exploit for CVE-2024-50498

CVE-2024-50498CRITICAL04 dez 2024

WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerability

75RISCO

abrir ↗

GitHub PoC

A Proof-of-Concept (PoC) exploit for CVE-2018-16763 (Fuel CMS - Preauthenticated Remote Code Execution).

CVE-2018-16763—04 dez 2024

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca

60RISCO

abrir ↗

GitHub PoC★ 4

based on [EQSTLab](https://github.com/EQSTLab)

CVE-2024-46538CRITICAL04 dez 2024

A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML v

70RISCO

abrir ↗

GitHub PoC★ 4

D1se0/CVE-2024-21413-Vulnerabilidad-Outlook-LAB

CVE-2024-21413CRITICALsob ataque04 dez 2024

Microsoft Outlook Remote Code Execution Vulnerability

100RISCO

abrir ↗

GitHub PoC★ 12

This repository contains a Proof of Concept (PoC) exploit for CVE-2024-11680, a critical vulnerability in ProjectSend r1605 and older versions. The exploit targets an improper authentication flaw due Privilege Misconfiguration issues.

CVE-2024-11680CRITICALsob ataque04 dez 2024

ProjectSend Unauthenticated Configuration Modification

100RISCO

abrir ↗

GitHub PoC

CVE-2024-10914 is a critical vulnerability affecting the D-Link DNS-320, DNS-320LW, DNS-325, and DNS-340L up to version 20241028. The function cgi_user_add in the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add is the culprit, allowing attackers to inject operating system commands remotely.

CVE-2024-10914CRITICAL04 dez 2024

D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

85RISCO

abrir ↗

GitHub PoC

Hunt3r850/CVE-2024-10924-PoC

CVE-2024-10924CRITICAL03 dez 2024

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

85RISCO

abrir ↗

GitHub PoC★ 9

threatlabindonesia/CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC

CVE-2023-44487HIGHsob ataque03 dez 2024

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many

93RISCO

abrir ↗

GitHub PoC

VictoriousKnight/CVE-2023-38831_Exploit

CVE-2023-38831HIGHsob ataqueransomware03 dez 2024

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a

100RISCO

abrir ↗

GitHub PoC★ 18

PoC for CVE-2024-42327 / ZBX-25623

CVE-2024-42327CRITICAL03 dez 2024

SQL injection in user.get API

70RISCO

abrir ↗

GitHub PoC

Hunt3r850/CVE-2024-10924-Wordpress-Docker

CVE-2024-10924CRITICAL03 dez 2024

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

85RISCO

abrir ↗

GitHub PoC★ 60

killvxk/CVE-2024-38193-Nephster

CVE-2024-38193HIGHsob ataque03 dez 2024

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

76RISCO

abrir ↗

GitHub PoC

specializzazione-cyber-security/demo-CVE-2021-29447-lezione

CVE-2021-29447HIGH03 dez 2024

WordPress Authenticated XXE attack when installation is running PHP 8

63RISCO

abrir ↗

GitHub PoC

Sebastianbedoya25/CVE-2021-3156

CVE-2021-3156HIGHsob ataque03 dez 2024

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RISCO

abrir ↗

GitHub PoC★ 13

Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution

CVE-2024-8672CRITICAL02 dez 2024

Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution

60RISCO

abrir ↗

GitHub PoC★ 2

congdong007/CVE-2024-45216-Poc

CVE-2024-45216CRITICAL02 dez 2024

Apache Solr: Authentication bypass possible using a fake URL Path ending

85RISCO

abrir ↗

GitHub PoC★ 4

D1se0/CVE-2024-10924-Bypass-MFA-Wordpress-LAB

CVE-2024-10924CRITICAL01 dez 2024

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

85RISCO

abrir ↗

GitHub PoC★ 37

cve-2024-42327 ZBX-25623

CVE-2024-42327CRITICAL01 dez 2024

SQL injection in user.get API

70RISCO

abrir ↗

GitHub PoC

Raeezrbr/CVE-2024-5084

CVE-2024-5084CRITICAL30 nov 2024

Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

75RISCO

abrir ↗

GitHub PoC

0xshoriful/CVE-2024-52380

CVE-2024-52380CRITICAL30 nov 2024

WordPress Picsmize plugin <= 1.0.0 - Arbitrary File Upload vulnerability

48RISCO

abrir ↗

GitHub PoC

dagowda/Zabbix-cve-2022-23131-SSO-bypass

CVE-2022-23131CRITICALsob ataque30 nov 2024

Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML

100RISCO

abrir ↗

GitHub PoC★ 18

PoC CVE-2023-28205: Apple WebKit Use-After-Free Vulnerability

CVE-2023-28205HIGHsob ataque30 nov 2024

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 a

76RISCO

abrir ↗

GitHub PoC

CVE-2023-41425 (XSS to RCE, Wonder CMS 3.2.0 <= 3.4.2)

CVE-2023-41425MEDIUM30 nov 2024

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code

60RISCO

abrir ↗

GitHub PoC

0xshoriful/CVE-2024-10470

CVE-2024-10470CRITICAL30 nov 2024

WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion

60RISCO

abrir ↗

GitHub PoC★ 3

CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015) RCE POC

CVE-2024-0012CRITICALsob ataqueransomware30 nov 2024

PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

100RISCO

abrir ↗

GitHub PoC

alyaapm/CVE-2025-55182-shellinteractive

CVE-2025-55182CRITICALsob ataqueransomware29 nov 2024

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

abrir ↗

GitHub PoC★ 2

Quantum-Sicarius/CVE-2024-49369

CVE-2024-49369CRITICAL29 nov 2024

Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections

48RISCO

abrir ↗

GitHub PoC★ 5

POC - CVE-2024-21534 Jsonpath-plus vulnerable to Remote Code Execution (RCE) due to improper input sanitization

CVE-2024-21534CRITICAL28 nov 2024

All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitizati

48RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.