Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
81.453exploits catalogados
37.908CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.482Referência 24.237GitHub PoC 15.653VulnCheck XDB 9.134Nuclei 4.441Metasploit 3.506✓ só verificadosrecentespopularesrisco
81.064 exploits
VulnCheck XDB
initial-access
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISCO
abrir ↗GitHub PoC★ 3
A go implementation for CVE-2024-9264 which effect grafana versions 11.0.x, 11.1.x, and 11.2.x.
Grafana SQL Expressions allow for remote code execution
85RISCO
abrir ↗VulnCheck XDB
initial-access
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers'
85RISCO
abrir ↗GitHub PoC
davidxbors/CVE-2024-7399-POC
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 2
100RISCO
abrir ↗GitHub PoC
MQKGitHub/Moniker-Link-CVE-2024-21413
Microsoft Outlook Remote Code Execution Vulnerability
100RISCO
abrir ↗VulnCheck XDB
remote-with-credentials
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and exe
83RISCO
abrir ↗VulnCheck XDB
initial-access
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 2
100RISCO
abrir ↗GitHub PoC★ 5
ScadaFlare Authenticated RCE Exploit Framework for ScadaBR (CVE-2021-26828) OpenPLC ScadaBR
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and exe
83RISCO
abrir ↗GitHub PoC
This script checks for the OpenSSH 7.7 (and prior) username enumeration vulnerability (CVE-2018-15473). It sends a malformed authentication packet and interprets the SSH server’s response to identify valid usernames.
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati
70RISCO
abrir ↗GitHub PoC
Automated bash script which scans an ip for potential vulnerability to eternalblue using nmap and then exploit using metasploit framework which uses the CVE-2017-0144 vulnerability[Code name: EternalBlue] in (windows 7,windows 2008 servers,etc.) to gain access to a windows 7 machine and establish a reverse meterpreter shell.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISCO
abrir ↗GitHub PoC★ 4
WordPress TI WooCommerce Wishlist Plugin <= 2.9.2 Arbitrary File Upload
WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerability
63RISCO
abrir ↗GitHub PoC
thompson005/CVE-2023-22527
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated atta
100RISCO
abrir ↗GitHub PoC★ 5
nkuty/CVE-2025-30208-31125-31486-32395
Vite bypasses server.fs.deny when using `?raw??`
70RISCO
abrir ↗Exploit-DB
WordPress Digits Plugin 8.4.6.1 - Authentication Bypass via OTP Bruteforcing
Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing
53RISCO
abrir ↗GitHub PoC
Updated exploit for CVE-2021-22911 (Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated))
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
60RISCO
abrir ↗Exploit-DB
Fortra GoAnywhere MFT 7.4.1 - Authentication Bypass
Authentication Bypass in GoAnywhere MFT
85RISCO
abrir ↗VulnCheck XDB
initial-access
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers'
85RISCO
abrir ↗GitHub PoC
vulnerable-nextjs-14-CVE-2025-29927
Authorization Bypass in Next.js Middleware
85RISCO
abrir ↗Exploit-DB
SolarWinds Serv-U 15.4.2 HF1 - Directory Traversal
SolarWinds Serv-U L Directory Transversal Vulnerability
100RISCO
abrir ↗VulnCheck XDB
remote-with-credentials
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
60RISCO
abrir ↗Exploit-DB
Automic Agent 24.3.0 HF4 - Privilege Escalation
Broadcom Automic Automation Agent Unix privilege escalation
41RISCO
abrir ↗Exploit-DB
Windows File Explorer Windows 11 (23H2) - NTLM Hash Disclosure
Microsoft Windows File Explorer Spoofing Vulnerability
38RISCO
abrir ↗GitHub PoC★ 11
Critical Unauthenticated API Access in vBulletin
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers'
85RISCO
abrir ↗Exploit-DB
Campcodes Online Hospital Management System 1.0 - SQL Injection
Campcodes Online Hospital Management System betweendates-detailsreports.php sql injection
33RISCO
abrir ↗GitHub PoC★ 4
Exploited CVE-2025-24071 via SMB by hosting a .library-ms file inside a .tar archive. Using tar x from smbclient, the payload is extracted server-side without user interaction. Responder captures the NTLM hash once the target accesses the library.
Microsoft Windows File Explorer Spoofing Vulnerability
38RISCO
abrir ↗VulnCheck XDB
infoleak
Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection
56RISCO
abrir ↗GitHub PoC
AzkOsDev/CVE-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.