Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
89.220exploits catalogados
41.197CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.738Exploit-DB 24.490GitHub PoC 18.525inteligência de exploração 11.299Nuclei 4.626Metasploit 3.542✓ só verificadosrecentespopularesrisco
89.220 exploits
remote-with-credentials
Libblockdev: lpe from allow_active to root in libblockdev via udisks
41RISCO
GitHub PoC★ 1
CVE-2025-49132: Pterodactyl Panel UnauthN LFI to RCE (w/ pearcmd) in posix sh
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISCO
abrir ↗GitHub PoC★ 4
Auto exploit for CVE-2025-6018 & CVE-2025-6019 based on https://github.com/0rionCollector/Exploit-Chain-CVE-2025-6018-6019
Pam-config: lpe from unprivileged to allow_active in pam
41RISCO
abrir ↗GitHub PoC
bixiPRO/Drupalgeddon2-CVE-2018-7600
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISCO
abrir ↗GitHub PoC★ 1
George0Papasotiriou/CVE-2025-61882-Oracle-BI-Publisher-RCE
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integratio
100RISCO
abrir ↗GitHub PoC★ 2
SumatraPDF versions 3.5.0 to 3.5.2 disable TLS hostname verification during update checks # (using INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and do not perform any signature or integrity # validation on the downloaded installer.
SumatraPDF Update MITM -> Arbitrary Code Execution
41RISCO
abrir ↗remote-with-credentials
20RISCO
initial-access
Simple File List < 4.2.3 - Remote Code Execution
75RISCO
initial-access
A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53
60RISCO
local
Libblockdev: lpe from allow_active to root in libblockdev via udisks
41RISCO
GitHub PoC★ 12
CVE-2025-6018 + CVE-2025-6019 Privilege Escalation Exploit
Pam-config: lpe from unprivileged to allow_active in pam
41RISCO
abrir ↗GitHub PoC★ 1
An exploitation tool for the Next.js vulnerability CVE-2025-55182 that allows remote command execution through a poisoning prototype in React Server Components.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC
ISabbiI/PoC---CVE-2023-26482-RCE-LAB-Nextcloud
Scope of workflow operations is not validated in nextcloud server
63RISCO
abrir ↗GitHub PoC★ 1
This repo contains RCE exploit for Pterodactyl htb machine
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISCO
abrir ↗GitHub PoC★ 1
This is just a quick note on how to exploit these vulnerabilities to get root.
Pam-config: lpe from unprivileged to allow_active in pam
41RISCO
abrir ↗GitHub PoC
CVE-2025-9074: Docker Desktop LPE via Docker Engine API wo/ AuthN in posix sh
Docker Desktop allows unauthenticated access to Docker Engine API from containers
48RISCO
abrir ↗GitHub PoC★ 1
IoCs and detection rules for the Notepad++ supply chain attack (CVE-2025-15556) — Lotus Blossom APT, June–December 2025. Includes Falcon LogScale queries, YARA/Sigma rules, and MITRE ATT&CK mapping.
Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification
71RISCO
abrir ↗GitHub PoC
HikVision Auth Bypass CVE, tool is able to extract credentials, and take snapshots based on magic cookie or supplied credentials.
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16
100RISCO
abrir ↗GitHub PoC★ 16
A Proof of Concept for chaining CVE-2025-6018 (PAM/Polkit Active Session Bypass) and CVE-2025-6019 (libblockdev SUID Mount Flaw) to achieve Local Privilege Escalation (LPE) on vulnerable Linux systems.
Pam-config: lpe from unprivileged to allow_active in pam
41RISCO
abrir ↗GitHub PoC
Proof-of-concept exploit for CVE-2017-12542, an authentication bypass vulnerability in HP iLO. Allows vulnerability detection and unauthorized account creation on affected systems
A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53
60RISCO
abrir ↗GitHub PoC★ 4
Exploit Chain of CVE-2025-6018 to CVE-2025-6019
Pam-config: lpe from unprivileged to allow_active in pam
41RISCO
abrir ↗local
Libblockdev: lpe from allow_active to root in libblockdev via udisks
41RISCO
initial-access
Libblockdev: lpe from allow_active to root in libblockdev via udisks
41RISCO
initial-access
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16
100RISCO
initial-access
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISCO
client-side
SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspeci
60RISCO
client-side
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
remote-with-credentials
Libblockdev: lpe from allow_active to root in libblockdev via udisks
41RISCO
GitHub PoC
mbanyamer/CVE-2026-25732-NiceGUI-3.6.1
NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
41RISCO
abrir ↗GitHub PoC
kerburenthusiasm/CVE-2025-49132-PoC
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e bases de inteligência de exploração. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.