Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

80.557exploits catalogados

37.313CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.478Referência 23.776GitHub PoC 15.367VulnCheck XDB 9.019Nuclei 4.415Metasploit 3.502✓ só verificadosrecentes populares risco

15.367 exploits

GitHub PoC

Python Proof of Concept for CVE-2023-1545 (SQL Injection for Teampass versions prior to 3.0.0.23).

CVE-2023-1545HIGH25 abr 2025

SQL Injection in nilsteampassnet/teampass

41RISCO

abrir ↗

GitHub PoC

CVE lab to accompany CVE course for CVE-2025-32433

CVE-2025-32433CRITICALsob ataque24 abr 2025

Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

100RISCO

abrir ↗

GitHub PoC

JIYUN02/cve-2021-41773

CVE-2021-41773HIGHsob ataqueransomware24 abr 2025

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

abrir ↗

GitHub PoC★ 3

Analysis of the Reproduction of CVE-2025-30208 Series Vulnerabilities

CVE-2025-30208MEDIUM24 abr 2025

Vite bypasses server.fs.deny when using `?raw??`

70RISCO

abrir ↗

GitHub PoC

Commvault CVE-2025-34028 endpoint scanner using Nmap NSE. For ethical testing and configuration validation.

CVE-2025-34028CRITICALsob ataque24 abr 2025

Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal

100RISCO

abrir ↗

GitHub PoC★ 12

Exploit for CVE-2025-30406

CVE-2025-30406CRITICALsob ataque24 abr 2025

Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the

100RISCO

abrir ↗

GitHub PoC

Jasurbek-Masimov/CVE-2018-15745

CVE-2018-15745—24 abr 2025

Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F

60RISCO

abrir ↗

GitHub PoC★ 1

tar-fs file write/overwrite vulnerability

CVE-2024-12905HIGH24 abr 2025

An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted

41RISCO

abrir ↗

GitHub PoC★ 3

CVE-2023-25157 exp

CVE-2023-25157CRITICAL24 abr 2025

Unfiltered SQL Injection Vulnerabilities in Geoserver

85RISCO

abrir ↗

GitHub PoC★ 1

Official Nuclei template for CVE-2025-31161 (formerly CVE-2025-2825)

CVE-2025-31161CRITICALsob ataqueransomware24 abr 2025

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle

100RISCO

abrir ↗

GitHub PoC

unzip-stream file write/overwrite vulnerability

CVE-2024-42471HIGH24 abr 2025

Arbitrary File Write via artifact extraction in actions/artifact

41RISCO

abrir ↗

GitHub PoC

CVE-2025-31161 python exploit

CVE-2025-31161CRITICALsob ataqueransomware24 abr 2025

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle

100RISCO

abrir ↗

GitHub PoC

Optimized exploit for CVE-2021-43857 affecting Gerapy < 0.9.8

CVE-2021-43857CRITICAL24 abr 2025

Gerapy may contain remote code execution vulnerability

60RISCO

abrir ↗

GitHub PoC★ 12

F5-Labs/parquet-canary-exploit-rce-poc-CVE-2025-30065

CVE-2025-30065CRITICAL23 abr 2025

Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata

60RISCO

abrir ↗

GitHub PoC★ 2

CVE-2025-29927: Next.js Middleware Bypass Vulnerability

CVE-2025-29927CRITICAL23 abr 2025

Authorization Bypass in Next.js Middleware

85RISCO

abrir ↗

GitHub PoC

Hands-on SOC investigation of CVE-2024-49138 using LetsDefend, VirusTotal, Hybrid Analysis, TrueFort, and ChatGPT.

CVE-2024-49138HIGHsob ataque23 abr 2025

Windows Common Log File System Driver Elevation of Privilege Vulnerability

76RISCO

abrir ↗

GitHub PoC★ 1

inok009/FOXCMS-CVE-2025-29306-POC

CVE-2025-29306CRITICAL22 abr 2025

An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.htm

75RISCO

abrir ↗

GitHub PoC★ 1

Tool designed to scan a list of websites for a known vulnerability in the PHPUnit framework, specifically the CVE-2017-9841 vulnerability.

CVE-2017-9841CRITICALsob ataque22 abr 2025

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c

100RISCO

abrir ↗

GitHub PoC★ 21

Proof of Concept for the NTLM Hash Leak via .library-ms CVE-2025-24054 / CVE-2025-24071

CVE-2025-24054MEDIUMsob ataque22 abr 2025

NTLM Hash Disclosure Spoofing Vulnerability

75RISCO

abrir ↗

GitHub PoC★ 1

Demo for detection and mitigation of HTTP/2 Rapid Reset vulnerability (CVE-2023-44487)

CVE-2023-44487HIGHsob ataque22 abr 2025

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many

93RISCO

abrir ↗

GitHub PoC★ 1

Proof of Concept Exploit for CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential Vulnerability

CVE-2024-28987CRITICALsob ataque21 abr 2025

SolarWinds Web Help Desk Hardcoded Credential Vulnerability

100RISCO

abrir ↗

GitHub PoC★ 1

CVE-2025-30208 vite file read nuclei template

CVE-2025-30208MEDIUM21 abr 2025

Vite bypasses server.fs.deny when using `?raw??`

70RISCO

abrir ↗

GitHub PoC

pswalia2u/CVE-2025-24071_POC

CVE-2025-24071MEDIUM21 abr 2025

Microsoft Windows File Explorer Spoofing Vulnerability

38RISCO

abrir ↗

GitHub PoC★ 2

A critical RCE vulnerability has been identified in the Wazuh server due to unsafe deserialization in the wazuh-manager package. This bug affects Wazuh versions ≥ 4.4.0 and has been patched in version 4.9.1.

CVE-2025-24016CRITICALsob ataque21 abr 2025

Remote code execution in Wazuh server

100RISCO

abrir ↗

GitHub PoC★ 1

A CVSS 10.0-rated vulnerability in the parquet-avro Java module allows remote code execution via unsafe deserialization when parsing schemas. Tracked as CVE-2025-30065, this flaw affects Apache Parquet ≤ 1.15.0. All users must upgrade to version 1.15.1 immediately to mitigate exploitation risks.

CVE-2025-30065CRITICAL21 abr 2025

Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata

60RISCO

abrir ↗

GitHub PoC★ 118

CVE-2025-31200 - @Noahhw46 figured it out

CVE-2025-31200CRITICALsob ataque21 abr 2025

A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4

83RISCO

abrir ↗

GitHub PoC★ 2

pouriam23/Next.js-Middleware-Bypass-CVE-2025-29927-

CVE-2025-29927CRITICAL21 abr 2025

Authorization Bypass in Next.js Middleware

85RISCO

abrir ↗

GitHub PoC★ 2

CrushFTP CVE-2025-31161 Exploit Tool 🔓

CVE-2025-31161CRITICALsob ataqueransomware21 abr 2025

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle

100RISCO

abrir ↗

GitHub PoC

custiya/geoserver-CVE-2023-25157

CVE-2023-25157CRITICAL21 abr 2025

Unfiltered SQL Injection Vulnerabilities in Geoserver

85RISCO

abrir ↗

GitHub PoC

Bug Chain XSS (CVE-2020-35730 and CVE-2023-43770) to SQLi (CVE-2021-44026)

CVE-2023-43770MEDIUMsob ataque20 abr 2025

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with craft

75RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.