Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

80.646exploits catalogados

37.382CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.482Referência 23.825GitHub PoC 15.392VulnCheck XDB 9.029Nuclei 4.416Metasploit 3.502✓ só verificadosrecentes populares risco

15.392 exploits

GitHub PoC★ 3

CVE-2025-24813_POC

CVE-2025-24813CRITICALsob ataque14 mar 2025

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RISCO

abrir ↗

GitHub PoC

redpack-kr/CVE-2025-26319

CVE-2025-26319CRITICAL14 mar 2025

FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.

75RISCO

abrir ↗

GitHub PoC

Pei4AN/CVE-2025-28915

CVE-2025-28915CRITICAL14 mar 2025

WordPress ThemeEgg ToolKit plugin <= 1.2.9 - Arbitrary File Upload vulnerability

48RISCO

abrir ↗

GitHub PoC

DeividasTerechovas/SOC335-CVE-2024-49138-Exploitation-Detected

CVE-2024-49138HIGHsob ataque14 mar 2025

Windows Common Log File System Driver Elevation of Privilege Vulnerability

76RISCO

abrir ↗

GitHub PoC★ 1

Security Researcher

CVE-2025-24813CRITICALsob ataque14 mar 2025

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RISCO

abrir ↗

GitHub PoC

Webmin 1.580 /file/show.cgi Remote Code Execution

CVE-2012-2982—14 mar 2025

file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid

50RISCO

abrir ↗

GitHub PoC★ 1

User name enumeration against SSH daemons affected by CVE-2016-6210.

CVE-2016-6210MEDIUM14 mar 2025

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static

70RISCO

abrir ↗

GitHub PoC★ 11

cve-2025-24813验证脚本

CVE-2025-24813CRITICALsob ataque14 mar 2025

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RISCO

abrir ↗

GitHub PoC★ 198

his repository contains an automated Proof of Concept (PoC) script for exploiting **CVE-2025-24813**, a Remote Code Execution (RCE) vulnerability in Apache Tomcat. The vulnerability allows an attacker to upload a malicious serialized payload to the server, leading to arbitrary code execution via deserialization when specific conditions are met.

CVE-2025-24813CRITICALsob ataque14 mar 2025

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RISCO

abrir ↗

GitHub PoC★ 44

This lab guides you through setting up an environment to explore CVE-2019-2215, a critical Android kernel vulnerability in the binder subsystem.

CVE-2019-2215HIGHsob ataque13 mar 2025

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

100RISCO

abrir ↗

GitHub PoC★ 1

HUSKY – Products Filter Professional for WooCommerce < 1.3.6.6 - Local File Inclusion PoC

CVE-2025-1661CRITICAL13 mar 2025

HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion

75RISCO

abrir ↗

GitHub PoC★ 97

Apache Tomcat 远程代码执行漏洞批量检测脚本(CVE-2025-24813)

CVE-2025-24813CRITICALsob ataque13 mar 2025

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RISCO

abrir ↗

GitHub PoC

CVE-2021-44228

CVE-2021-44228CRITICALsob ataqueransomware12 mar 2025

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

abrir ↗

GitHub PoC★ 1

POC for CVE-2025-26240

CVE-2025-26240HIGH12 mar 2025

In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of t

41RISCO

abrir ↗

GitHub PoC★ 1

MS17-010 (CVE-2017-0143) - Python3 Script

CVE-2017-0143HIGHsob ataqueransomware12 mar 2025

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISCO

abrir ↗

GitHub PoC★ 8

tinashelorenzi/CVE-2023-30258-magnus-billing-v7-exploit

CVE-2023-30258CRITICAL12 mar 2025

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary com

85RISCO

abrir ↗

GitHub PoC★ 1

WordPress ThemeEgg ToolKit plugin <= 1.2.9 - Arbitrary File Upload vulnerability

CVE-2025-28915CRITICAL12 mar 2025

WordPress ThemeEgg ToolKit plugin <= 1.2.9 - Arbitrary File Upload vulnerability

48RISCO

abrir ↗

GitHub PoC

PoC Exploit for CVE-2015-0009 (SMB Signing)

CVE-2015-0009—12 mar 2025

The Group Policy Security Configuration policy implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, W

23RISCO

abrir ↗

GitHub PoC

CVE-2024-8289 https://www.cve.org/CVERecord?id=CVE-2024-8289, Vendor wcmp Product MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution

CVE-2024-8289CRITICAL11 mar 2025

MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover

48RISCO

abrir ↗

GitHub PoC

Remote code execution running on w3 total cache cve 2013-2010

CVE-2013-2010—11 mar 2025

WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability

60RISCO

abrir ↗

GitHub PoC

KQL para deteccion de CVE-2025-21333 en Sentinel

CVE-2025-21333HIGHsob ataque11 mar 2025

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

71RISCO

abrir ↗

GitHub PoC

In this project, I documented a detailed penetration testing process targeting Apache HTTP Server vulnerabilities, specifically CVE-2021-41773 and CVE-2021-42013, which involve Path Traversal and Remote Code Execution (RCE).

CVE-2021-41773HIGHsob ataqueransomware11 mar 2025

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

abrir ↗

GitHub PoC

CVE-2017-11882 Preventer for .docx files

CVE-2017-11882HIGHsob ataqueransomware11 mar 2025

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi

100RISCO

abrir ↗

GitHub PoC

CVE-2024-54383, https://www.cve.org/CVERecord?id=CVE-2024-54383

CVE-2024-54383CRITICAL11 mar 2025

WordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Broken Authentication vulnerability

48RISCO

abrir ↗

GitHub PoC

CVE-2024-10924 - Authentication Bypass in ReallySimpleSSL Wordpress Plugin

CVE-2024-10924CRITICAL11 mar 2025

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

85RISCO

abrir ↗

GitHub PoC

Sp4ceDogy/NPE-CS-V-CVE-2021-1675

CVE-2021-1675HIGHsob ataqueransomware10 mar 2025

Windows Print Spooler Remote Code Execution Vulnerability

100RISCO

abrir ↗

GitHub PoC★ 3

Ivanti Remote code execution

CVE-2025-0282CRITICALsob ataqueransomware10 mar 2025

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7

100RISCO

abrir ↗

GitHub PoC★ 15

Exploit for CVE-2024-0402 in Gitlab

CVE-2024-0402CRITICAL10 mar 2025

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

48RISCO

abrir ↗

GitHub PoC

Sornphut/CVE-2021-3156-Heap-Based-Buffer-Overflow-in-Sudo-Baron-Samedit-

CVE-2021-3156HIGHsob ataque10 mar 2025

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RISCO

abrir ↗

GitHub PoC★ 4

Unauthenticated remote command execution in Papercut service allows an attacker to execute commands due to improper access controls in the SetupCompleted Java class.

CVE-2023-27350CRITICALsob ataqueransomware09 mar 2025

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bui

100RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.