Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
81.453exploits catalogados
37.908CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.482Referência 24.237GitHub PoC 15.653VulnCheck XDB 9.134Nuclei 4.441Metasploit 3.506✓ só verificadosrecentespopularesrisco
81.064 exploits
GitHub PoC
Authenticated Remote Command Execution - Webmin <= 1.910
In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root pr
60RISCO
abrir ↗GitHub PoC
An exploit automation script that builds upon the work of Voidzone security.
ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulti
55RISCO
abrir ↗GitHub PoC
Superliverbun/cve-2021-3156-
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISCO
abrir ↗GitHub PoC
Authenticated Remote Command Execution – pfSense <= 2.1.3
pfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via (1) the hostname value to diag_
23RISCO
abrir ↗GitHub PoC★ 1
A XZ backdoor vulnerability explained in details
Xz: malicious code in distributed source
70RISCO
abrir ↗VulnCheck XDB
initial-access
Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
70RISCO
abrir ↗GitHub PoC
For CTF use only (the CVE-2019-7214 also resolves the host from /etc/hosts)
SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker co
60RISCO
abrir ↗VulnCheck XDB
infoleak
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baske
48RISCO
abrir ↗VulnCheck XDB
initial-access
SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation
78RISCO
abrir ↗GitHub PoC
imbas007/CVE-2025-4123-template
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
78RISCO
abrir ↗GitHub PoC★ 3
pgAdmin Proof of Concept
pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment
75RISCO
abrir ↗VulnCheck XDB
client-side
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
78RISCO
abrir ↗GitHub PoC
Authenticated Remote Command Execution – pfSense <= 2.1.3
pfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via (1) the hostname value to diag_
23RISCO
abrir ↗GitHub PoC★ 5
Detection for CVE-2025-49113
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the
100RISCO
abrir ↗GitHub PoC★ 2
r007sec/CVE-2024-53677
Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
70RISCO
abrir ↗Metasploit600
Roundcube Post-Auth RCE via PHP Object Deserialization
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the
100RISCO
abrir ↗VulnCheck XDB
initial-access
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 20
100RISCO
abrir ↗GitHub PoC
Reflected XSS vulnerability in MikroTik Hotspot login page
Cross-site scripting via dst parameter in RouterOS WiFi hotspot
33RISCO
abrir ↗VulnCheck XDB
infoleak
TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR L
60RISCO
abrir ↗GitHub PoC★ 1
MS08-067 | CVE-2008-4250
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 20
100RISCO
abrir ↗GitHub PoC★ 3
A reflected cross-site scripting (XSS) vulnerability exists in MailEnable Webmail due to improper user input sanitization in the failure.aspx. This allows a remote attacker to inject arbitrary JavaScript code via a crafted URL, which is then reflected in the server's response and executed in the context of the user's browser session.
Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via
75RISCO
abrir ↗GitHub PoC★ 2
CVE 2023 25690 Proof of concept - mod_proxy vulnerable configuration on Apache HTTP Server versions 2.4.0 - 2.4.55 leads to HTTP Request Smuggling vulnerability.
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
70RISCO
abrir ↗VulnCheck XDB
infoleak
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
70RISCO
abrir ↗GitHub PoC★ 1
fatkz/CVE-2025-27590
In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain contr
53RISCO
abrir ↗GitHub PoC★ 3
A go implementation for CVE-2024-9264 which effect grafana versions 11.0.x, 11.1.x, and 11.2.x.
Grafana SQL Expressions allow for remote code execution
85RISCO
abrir ↗VulnCheck XDB
infoleak
Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection
56RISCO
abrir ↗GitHub PoC★ 67
Remote Code Execution via Use-After-Free in JScript.dll (CVE-2025-30397)
Scripting Engine Memory Corruption Vulnerability
76RISCO
abrir ↗GitHub PoC
Vbullettin RCE - CVE-2025-48827
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers'
85RISCO
abrir ↗VulnCheck XDB
initial-access
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.