Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

81.064exploits catalogados

37.667CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.482Referência 24.044GitHub PoC 15.521VulnCheck XDB 9.080Nuclei 4.432Metasploit 3.505✓ só verificadosrecentes populares risco

80.930 exploits

Exploit-DB

Concrete CMS 9.4.3 - Stored XSS

CVE-2025-8573LOWwebappsmultiple16 set 2025

Concrete CMS 9 through 9.4.2 is vulnerable to Stored XSS from Home Folder on Members Dashboard page

28RISCO

abrir ↗

GitHub PoC

A Rust implementation of the CVE-2014-6287 exploit targeting Rejetto HTTP File Server (HFS) versions 2.3x before 2.3c.

CVE-2014-6287CRITICALsob ataque16 set 2025

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a

100RISCO

abrir ↗

Exploit-DB

ClipBucket 5.5.2 Build #90 - Server-Side Request Forgery (SSRF)

CVE-2025-55911MEDIUMremotemultiple16 set 2025

An issue Clip Bucket v.5.5.2 Build#90 allows a remote attacker to execute arbitrary codes via the file_downloader.php an

33RISCO

abrir ↗

GitHub PoC★ 2

Example PoC for CVE-2025-24813 (Tomcat RCE)

CVE-2025-24813CRITICALsob ataque16 set 2025

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RISCO

abrir ↗

GitHub PoC

CVE-2019-3396 confluence SSTI RCE

CVE-2019-3396CRITICALsob ataqueransomware16 set 2025

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from vers

100RISCO

abrir ↗

Exploit-DB

HTTP/2 2.0 - Denial Of Service (DOS)

CVE-2023-44487HIGHsob ataqueremotemultiple16 set 2025

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many

93RISCO

abrir ↗

Exploit-DB

dotCMS 25.07.02-1 - Authenticated Blind SQL Injection

CVE-2025-8311CRITICALwebappsmultiple16 set 2025

dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpo

48RISCO

abrir ↗

GitHub PoC★ 2

RedArrow3.2 是一款用于渗透测试ThinkPHP 5.0.23 远程命令执行漏洞(CVE-2018-20062)的图形化工具。

CVE-2018-20062CRITICALsob ataque16 set 2025

An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP

100RISCO

abrir ↗

GitHub PoC

tranphuc2005/CVE-2017-9822

CVE-2017-9822HIGHsob ataqueransomware15 set 2025

DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code e

100RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2017-12611—15 set 2025

In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag in

60RISCO

abrir ↗

VulnCheck XDB

remote-with-credentials

CVE-2017-9822HIGHsob ataqueransomware15 set 2025

DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code e

100RISCO

abrir ↗

GitHub PoC

Authentication bypass vulnerability in versions of the CrushFTP server.

CVE-2025-31161CRITICALsob ataqueransomware15 set 2025

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle

100RISCO

abrir ↗

GitHub PoC

tcetin704/CVE-2017-12611

CVE-2017-12611—15 set 2025

In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag in

60RISCO

abrir ↗

VulnCheck XDB

client-side

CVE-2025-48384HIGHsob ataque15 set 2025

Git allows arbitrary code execution through broken config quoting

71RISCO

abrir ↗

GitHub PoC★ 3

Langflow Remote Code Execution

CVE-2025-3248CRITICALsob ataqueransomware15 set 2025

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

100RISCO

abrir ↗

GitHub PoC

0xDTC/js2py-Sandbox-Escape-CVE-2024-28397-RCE

CVE-2024-28397MEDIUM15 set 2025

An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a

48RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2025-3248CRITICALsob ataqueransomware15 set 2025

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

100RISCO

abrir ↗

GitHub PoC

Shubhankargupta691/CVE-2024-42009

CVE-2024-42009CRITICALsob ataque14 set 2025

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea

100RISCO

abrir ↗

GitHub PoC

shoucheng3/apache__dolphinscheduler_CVE-2023-49109_3_2_1_fixed

CVE-2023-49109CRITICAL14 set 2025

Remote Code Execution in Apache Dolphinscheduler

48RISCO

abrir ↗

VulnCheck XDB

client-side

CVE-2025-8088HIGHsob ataqueransomware14 set 2025

Path traversal vulnerability in WinRAR

93RISCO

abrir ↗

GitHub PoC

CVE-2025-26264 - GeoVision GV-ASWeb with the version 6.1.2.0 or less, contains a Remote Code Execution (RCE) vulnerability within its Notification Settings feature. An authenticated attacker with "System Settings" privileges in ASWeb can exploit this flaw to execute arbitrary commands on the server, leading to a full system compromise.

CVE-2025-26264HIGH14 set 2025

GeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerabili

46RISCO

abrir ↗

GitHub PoC★ 1

Safe, read-only SQL Injection checker for FreePBX (CVE-2025-57819), using error/boolean/time-based techniques with per-parameter verdicts and JSON reporting.

CVE-2025-57819CRITICALsob ataque14 set 2025

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISCO

abrir ↗

GitHub PoC

Documented CVE-2021-41773 (Apache HTTP Server path traversal, CVSS 9.8) — produced CVSS breakdown, impact assessment, and a mitigation plan (patch to 2.4.51+, CGI disable, firewall) and published the analysis on GitHub.

CVE-2021-41773HIGHsob ataqueransomware14 set 2025

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISCO

abrir ↗

GitHub PoC

A proof-of-concept exploit for WinRAR vulnerability (CVE-2025-8088) affecting versions 7.12 and lower. This tool creates a malicious RAR archive that embeds payloads in Alternate Data Streams (ADS) with path traversal, potentially leading to arbitrary code execution.

CVE-2025-8088HIGHsob ataqueransomware14 set 2025

Path traversal vulnerability in WinRAR

93RISCO

abrir ↗

VulnCheck XDB

infoleak

CVE-2025-57819CRITICALsob ataque14 set 2025

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISCO

abrir ↗

VulnCheck XDB

local

CVE-2025-48543HIGHsob ataque14 set 2025

In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use aft

71RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2025-54309CRITICALsob ataque13 set 2025

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and

100RISCO

abrir ↗

VulnCheck XDB

local

CVE-2021-3493HIGHsob ataque13 set 2025

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o

98RISCO

abrir ↗

VulnCheck XDB

initial-access

CVE-2025-53770CRITICALsob ataqueransomware13 set 2025

Microsoft SharePoint Server Remote Code Execution Vulnerability

100RISCO

abrir ↗

VulnCheck XDB

client-side

CVE-2025-48384HIGHsob ataque13 set 2025

Git allows arbitrary code execution through broken config quoting

71RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.