Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

80.557exploits catalogados

37.313CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.478Referência 23.776GitHub PoC 15.367VulnCheck XDB 9.019Nuclei 4.415Metasploit 3.502✓ só verificadosrecentes populares risco

15.367 exploits

GitHub PoC★ 1

This Python script exploits CVE-2025-3248 to execute arbitrary commands or spawn a reverse shell on a vulnerable system. Authentication is required to use this exploit.

CVE-2025-3248CRITICALsob ataqueransomware31 mai 2025

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

100RISCO

GitHub PoC★ 1

fatkz/CVE-2025-27590

CVE-2025-27590CRITICAL31 mai 2025

In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain contr

53RISCO

GitHub PoC★ 4

WordPress TI WooCommerce Wishlist Plugin <= 2.9.2 Arbitrary File Upload

CVE-2025-47577CRITICAL30 mai 2025

WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerability

63RISCO

GitHub PoC

davidxbors/CVE-2024-7399-POC

CVE-2024-7399HIGHsob ataque30 mai 2025

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 2

100RISCO

GitHub PoC

This script checks for the OpenSSH 7.7 (and prior) username enumeration vulnerability (CVE-2018-15473). It sends a malformed authentication packet and interprets the SSH server’s response to identify valid usernames.

CVE-2018-15473MEDIUM30 mai 2025

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati

70RISCO

GitHub PoC

MQKGitHub/Moniker-Link-CVE-2024-21413

CVE-2024-21413CRITICALsob ataque30 mai 2025

Microsoft Outlook Remote Code Execution Vulnerability

100RISCO

GitHub PoC

Automated bash script which scans an ip for potential vulnerability to eternalblue using nmap and then exploit using metasploit framework which uses the CVE-2017-0144 vulnerability[Code name: EternalBlue] in (windows 7,windows 2008 servers,etc.) to gain access to a windows 7 machine and establish a reverse meterpreter shell.

CVE-2017-0144HIGHsob ataqueransomware30 mai 2025

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISCO

GitHub PoC★ 5

ScadaFlare Authenticated RCE Exploit Framework for ScadaBR (CVE-2021-26828) OpenPLC ScadaBR

CVE-2021-26828HIGHsob ataque30 mai 2025

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and exe

83RISCO

GitHub PoC

Updated exploit for CVE-2021-22911 (Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated))

CVE-2021-22911—29 mai 2025

A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti

60RISCO

GitHub PoC

thompson005/CVE-2023-22527

CVE-2023-22527CRITICALsob ataqueransomware29 mai 2025

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated atta

100RISCO

GitHub PoC★ 5

nkuty/CVE-2025-30208-31125-31486-32395

CVE-2025-30208MEDIUM29 mai 2025

Vite bypasses server.fs.deny when using `?raw??`

70RISCO

GitHub PoC★ 11

Critical Unauthenticated API Access in vBulletin

CVE-2025-48827CRITICAL29 mai 2025

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers'

85RISCO

GitHub PoC

vulnerable-nextjs-14-CVE-2025-29927

CVE-2025-29927CRITICAL29 mai 2025

Authorization Bypass in Next.js Middleware

85RISCO

GitHub PoC

AzkOsDev/CVE-2021-41773

CVE-2021-41773HIGHsob ataqueransomware28 mai 2025

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

GitHub PoC★ 4

Exploited CVE-2025-24071 via SMB by hosting a .library-ms file inside a .tar archive. Using tar x from smbclient, the payload is extracted server-side without user interaction. Responder captures the NTLM hash once the target accesses the library.

CVE-2025-24071MEDIUM28 mai 2025

Microsoft Windows File Explorer Spoofing Vulnerability

38RISCO

GitHub PoC★ 2

Telerik CVE-2017-9248 Vulnerability Scanner

CVE-2017-9248CRITICALsob ataque28 mai 2025

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not

100RISCO

GitHub PoC★ 3

CVE-2025-24071 Proof Of Concept

CVE-2025-24071MEDIUM27 mai 2025

Microsoft Windows File Explorer Spoofing Vulnerability

38RISCO

GitHub PoC

Log4Shell (CVE-2021-44228) exploit demo for SEAS 8405. Includes a vulnerable Spring Boot app, fake LDAP server, Docker setup, MITRE mapping, incident response, and a full screen recording.

CVE-2021-44228CRITICALsob ataqueransomware27 mai 2025

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

GitHub PoC

KimJuhyeong95/cve-2024-4577

CVE-2024-4577CRITICALsob ataqueransomware27 mai 2025

Argument Injection in PHP-CGI

100RISCO

GitHub PoC★ 1

Perform Remote Code Execution using vulnerable API endpoint.

CVE-2025-3248CRITICALsob ataqueransomware27 mai 2025

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

100RISCO

GitHub PoC

Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update

CVE-2025-2907CRITICAL26 mai 2025

Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update

63RISCO

GitHub PoC★ 5

JackHars/cve-2020-14008

CVE-2020-14008—26 mai 2025

Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in

35RISCO

GitHub PoC

🔐 Python-based smart scanner for CVE-2025-29927 — Next.js middleware authentication bypass vulnerability. Detects meta refresh, keyword-based redirects, and more.

CVE-2025-29927CRITICAL26 mai 2025

Authorization Bypass in Next.js Middleware

85RISCO

GitHub PoC

Windows File Explorer Spoofing Vulnerability - CVE-2025-24071

CVE-2025-24071MEDIUM26 mai 2025

Microsoft Windows File Explorer Spoofing Vulnerability

38RISCO

GitHub PoC★ 2

UMChacker/CVE-2024-55591-POC

CVE-2024-55591CRITICALsob ataqueransomware26 mai 2025

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 thro

100RISCO

GitHub PoC

The scripts in this repository are made to abuse CVE-2024-42008 and CVE-2024-42009. Both of these CVEs are vulnerabilities found on Roundcube 1.6.7

CVE-2024-42008CRITICAL26 mai 2025

A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7

60RISCO

GitHub PoC★ 3

ov3rf1ow/CVE-2025-27363

CVE-2025-27363HIGHsob ataque26 mai 2025

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when

76RISCO

GitHub PoC★ 19

Apache Tomcat - Remote Code Execution via Session Deserialization (CVE-2025-24813)

CVE-2025-24813CRITICALsob ataque25 mai 2025

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RISCO

GitHub PoC★ 1

aidana-gift/CVE-2025-0868

CVE-2025-0868CRITICAL25 mai 2025

Remote Code Execution in DocsGPT

68RISCO

GitHub PoC★ 1

PoC CVE-2025-22457

CVE-2025-22457CRITICALsob ataqueransomware25 mai 2025

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7

100RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.