Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
80.554exploits catalogados
37.311CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.478Referência 23.776GitHub PoC 15.364VulnCheck XDB 9.019Nuclei 4.415Metasploit 3.502✓ só verificadosrecentespopularesrisco
80.554 exploits
GitHub PoC★ 1
thomas-osgood/cve-2025-58360
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
98RISCO
abrir ↗GitHub PoC
CVE-2025-32433-available-for-windows
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISCO
abrir ↗GitHub PoC★ 5
GNU InetUtils telnetd - Unauthenticated Remote Root via NEW-ENVIRON Variable Injection.
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISCO
abrir ↗GitHub PoC★ 1
Spydomain/CVE-2021-22555-Poc
Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE
100RISCO
abrir ↗GitHub PoC
A docker image for CVE-2026-24061 in InetUtils telnetd.
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISCO
abrir ↗GitHub PoC★ 28
This Python PoC exploits CVE-2024-46987, a Path Traversal bug in Camaleon CMS 2.8.0 < 2.8.2 (work on 2.9.0). It allows authenticated users to read sensitive server files via the MediaController. Intended for authorized security auditing and educational research only.
Arbitrary path traversal in Camaleon CMS
61RISCO
abrir ↗VulnCheck XDB
initial-access
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISCO
abrir ↗GitHub PoC
Capture the Flag challenge: CVE-2025-29927 in combination with a command injection vulnerability
Authorization Bypass in Next.js Middleware
85RISCO
abrir ↗GitHub PoC★ 3
Exploiting CVE-2022-0847 - written by : Antonius (w1sdom)
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISCO
abrir ↗GitHub PoC★ 2
POC Script for CVE-2026-24061 (GNU Telnetd Exploit)
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISCO
abrir ↗GitHub PoC★ 17
Root Cause Analysis for CVE-2025-43529, a UAF vulnerability due to incorrect DFG StoreBarrierInsertionPhase in JavaScriptCore.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and
71RISCO
abrir ↗GitHub PoC
Dirty COW Privilege Escalation (CVE-2016-5195)
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISCO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC
Submodule repo for Backup Exec CVE-2024-32002 exploit
Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution
53RISCO
abrir ↗GitHub PoC★ 1
CVE-2025-40554 Exploitation
SolarWinds Web Help Desk Authentication Bypass Vulnerability
75RISCO
abrir ↗GitHub PoC
mbanyamer/deephas-1.0.7-Prototype-Pollution-PoC-CVE-2026-25047-
deepHas vulnerable to Prototype Pollution via constructor.prototype
48RISCO
abrir ↗GitHub PoC
React2shell exploit (CVE-2025-55182+CVE-2025-66478)
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗VulnCheck XDB
initial-access
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISCO
abrir ↗GitHub PoC
Superproject repo for Backup Exec CVE-2025-48384 exploit
Git allows arbitrary code execution through broken config quoting
71RISCO
abrir ↗GitHub PoC
Superproject repo for Backup Exec CVE-2024-32002 exploit
Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution
53RISCO
abrir ↗GitHub PoC★ 1
This is a simple PoC that allows you to highlight the severity of the ongoing and actively exploited Telnet bug that is going on right now. Why people are still using Telnet... beyond me.
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISCO
abrir ↗VulnCheck XDB
client-side
Git allows arbitrary code execution through broken config quoting
71RISCO
abrir ↗GitHub PoC
Scanner for CVE-2026-24061
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISCO
abrir ↗GitHub PoC★ 2
AsyncIO Scanner & Exploitation Framework for CVE-2026-24061 (Telnet NEW_ENVIRON Auth Bypass). Features high-concurrency discovery, passive fingerprinting, and authorized root shell escalation
IDOR in Universe Software's Online Registration and Workflow Management System
33RISCO
abrir ↗GitHub PoC
CTT-Terrminus-Vortex (CVE-2026-2406)
IDOR in Universe Software's Online Registration and Workflow Management System
33RISCO
abrir ↗GitHub PoC★ 3
1atakan1/CVE-2025-6934
Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'
68RISCO
abrir ↗VulnCheck XDB
local
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
85RISCO
abrir ↗GitHub PoC★ 1
webkit_refraction.js (The 33-Layer WebGL Payload) This JavaScript payload uses the \alpha constant to create a high-frequency "Memory Shiver." It induces the Use-After-Free (UAF) in CVE-2025-43529 by desynchronizing the WebKit garbage collector from the GPU's Metal command buffer.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and
71RISCO
abrir ↗GitHub PoC
afifudinmtop/CVE-2021-43857-Gerapy-v0.9.7
Gerapy may contain remote code execution vulnerability
60RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.