Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

80.646exploits catalogados

37.382CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.482Referência 23.825GitHub PoC 15.392VulnCheck XDB 9.029Nuclei 4.416Metasploit 3.502✓ só verificadosrecentes populares risco

15.392 exploits

GitHub PoC★ 2

Exploit for CVE-2025-0282: A remote unauthenticated stack based buffer overflow affecting Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways

CVE-2025-0282CRITICALsob ataqueransomware22 jan 2025

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7

100RISCO

GitHub PoC★ 4

themirze/cve-2024-12084

CVE-2024-12084CRITICAL21 jan 2025

Rsync: heap buffer overflow in rsync due to improper checksum length handling

70RISCO

GitHub PoC

Grow by Tradedoubler < 2.0.22 - Unauthenticated LFI

CVE-2024-6460CRITICAL21 jan 2025

Grow by Tradedoubler <= 2.0.21 - Unauthenticated LFI

63RISCO

GitHub PoC★ 12

Automated Reverse Shell Exploit via WebSocket | Havoc-C2-SSRF with RCE

CVE-2024-41570CRITICAL21 jan 2025

An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send

48RISCO

GitHub PoC

bananoname/CVE-2024-49138-POC

CVE-2024-49138HIGHsob ataque21 jan 2025

Windows Common Log File System Driver Elevation of Privilege Vulnerability

76RISCO

GitHub PoC★ 26

sysirq/fortios-auth-bypass-poc-CVE-2024-55591

CVE-2024-55591CRITICALsob ataqueransomware21 jan 2025

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 thro

100RISCO

GitHub PoC

ekcrsm/CVE-2024-23733

CVE-2024-23733HIGH21 jan 2025

The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core

41RISCO

GitHub PoC★ 1

CVE-2022-0847

CVE-2022-0847HIGHsob ataque21 jan 2025

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RISCO

GitHub PoC★ 8

This is a modified version of the CVE-2024-41570 SSRF PoC from @chebuya chained with the auth RCE exploit from @hyperreality. This exploit executes code remotely to a target due to multiple vulnerabilities in Havoc C2 Framework. (https://github.com/HavocFramework/Havoc)

CVE-2024-41570CRITICAL21 jan 2025

An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send

48RISCO

GitHub PoC

调试环境

CVE-2021-44228CRITICALsob ataqueransomware20 jan 2025

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISCO

GitHub PoC★ 15

CVE-2024-43451 is a Windows NTLM vulnerability that allows an attacker to force authentication and capture NTLM hashes by using malicious shortcuts.

CVE-2024-43451MEDIUMsob ataque20 jan 2025

NTLM Hash Disclosure Spoofing Vulnerability

85RISCO

GitHub PoC★ 198

Proof of concept & details for CVE-2025-21298

CVE-2025-21298CRITICAL20 jan 2025

Windows OLE Remote Code Execution Vulnerability

70RISCO

GitHub PoC★ 4

This is an altered PoC for d0rb/CVE-2024-6387. This takes glibc addresses and trys to exploit the CVE through them.

CVE-2024-6387HIGH20 jan 2025

Openssh: regresshion - race condition in ssh allows rce/dos

63RISCO

GitHub PoC★ 2

POC for CVE-2023-40028: Ghost CMS Arbitrary File Read

CVE-2023-40028MEDIUM20 jan 2025

Arbitrary file read via symlinks in Ghost

45RISCO

GitHub PoC★ 5

A Python script for examining Ivanti Secure Connect (ICS) event logs, designed to support investigations into vulnerabilities CVE-2025-0282, CVE-2023-46805, and CVE-2024-21887.

CVE-2023-46805HIGHsob ataqueransomware19 jan 2025

An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a re

100RISCO

GitHub PoC★ 5

A Python script for examining Ivanti Secure Connect (ICS) event logs, designed to support investigations into vulnerabilities CVE-2025-0282, CVE-2023-46805, and CVE-2024-21887.

CVE-2024-21887CRITICALsob ataqueransomware19 jan 2025

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x,

100RISCO

GitHub PoC★ 3

This is a Chained RCE in the Havoc C2 framework using github.com/chebuya and github.com/IncludeSecurity pocs

CVE-2024-41570CRITICAL19 jan 2025

An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send

48RISCO

GitHub PoC★ 16

Havoc SSRF to RCE

CVE-2024-41570CRITICAL19 jan 2025

An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send

48RISCO

GitHub PoC★ 5

A Python script for examining Ivanti Secure Connect (ICS) event logs, designed to support investigations into vulnerabilities CVE-2025-0282, CVE-2023-46805, and CVE-2024-21887.

CVE-2025-0282CRITICALsob ataqueransomware19 jan 2025

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7

100RISCO

GitHub PoC★ 1

masa42/CVE-2024-38821-POC

CVE-2024-38821CRITICAL18 jan 2025

Authorization Bypass of Static Resources in WebFlux Applications

48RISCO

GitHub PoC★ 1

RapidResetClient

CVE-2023-44487HIGHsob ataque18 jan 2025

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many

93RISCO

GitHub PoC★ 3

Picsmize plugin for WordPress is vulnerable to arbitrary file uploads.

CVE-2024-52380CRITICAL18 jan 2025

WordPress Picsmize plugin <= 1.0.0 - Arbitrary File Upload vulnerability

48RISCO

GitHub PoC

PoC: Plugin: Zita Site Builder <= 1.0.2 - Arbitrary Plugin Installation

CVE-2024-54369CRITICAL18 jan 2025

WordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerability

48RISCO

GitHub PoC★ 3

CVE-2024-43468 SCCM SQL Injection Exploit (mTLS unextractable client cert from MacOS keychain version)

CVE-2024-43468CRITICALsob ataque17 jan 2025

Microsoft Configuration Manager Remote Code Execution Vulnerability

100RISCO

GitHub PoC★ 1

c1ph3rbyt3/CVE-2022-24816

CVE-2022-24816CRITICALsob ataque17 jan 2025

Improper Control of Generation of Code in jai-ext

100RISCO

GitHub PoC★ 15

CVE-2024-57727

CVE-2024-57727CRITICALsob ataqueransomware17 jan 2025

SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enabl

100RISCO

GitHub PoC

c1ph3rbyt3/CVE-2022-29464

CVE-2022-29464CRITICALsob ataqueransomware17 jan 2025

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RISCO

GitHub PoC

This is a repository that aims to provide research material on CVE-2020-14882 as part of a project in partial fullfilment of ACS EDU Program.

CVE-2020-14882CRITICALsob ataque17 jan 2025

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

100RISCO

GitHub PoC

Exploit CVE-2024-54262: Arbitrary File Upload in Import Export for WooCommerce

CVE-2024-54262CRITICAL17 jan 2025

WordPress Import Export For WooCommerce plugin <= 1.6.2 - Arbitrary File Upload vulnerability

48RISCO

GitHub PoC★ 1

Proof of concept for CVE-2022-31814

CVE-2022-31814CRITICAL16 jan 2025

pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metachar

85RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.