Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
89.220exploits catalogados
41.197CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.738Exploit-DB 24.490GitHub PoC 18.525inteligência de exploração 11.299Nuclei 4.626Metasploit 3.542✓ só verificadosrecentespopularesrisco
89.220 exploits
GitHub PoC★ 3
Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder'
Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder'
48RISCO
abrir ↗GitHub PoC
POC for CVE-2025-33053 WebDav Exploit, demonstrating how the vulnerability can be triggered in a real environment. This repository focuses on hands-on exploitation steps, reproducible test cases, and observable impact, helping security researchers and defenders understand the issue and validate fixes.
Internet Shortcut Files Remote Code Execution Vulnerability
100RISCO
abrir ↗GitHub PoC★ 4
React2Shell (CVE-2025-66478): A Python-based Proof of Concept for Critical Remote Code Execution (RCE) in Next.js Server Components. Features an interactive CLI, custom payload injection, and cleaner output formatting. For educational research only.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC★ 4
This is a Proof-Of-Concept of CVE-2025-63353
A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-s
48RISCO
abrir ↗initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
GitHub PoC★ 22
Script to detect CVE-2025-20393 for Cisco Secure Email Gateway And Cisco Secure Email and Web Manager
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability
90RISCO
abrir ↗GitHub PoC
KingHacker353/CVE-2025-20393
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability
90RISCO
abrir ↗initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
initial-access
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
100RISCO
GitHub PoC
Improved poc of CVE-2017-0785 on DS-MDP002
A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.
28RISCO
abrir ↗GitHub PoC★ 1
proof-of-concept mass scanner targeting JetBrains TeamCity instances affected by CVE-2024-27198
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
100RISCO
abrir ↗GitHub PoC★ 2
Proof-of-concept research tool for CVE-2025-55182, a critical unauthenticated RCE in Next.js App Router caused by server-side object injection in React Server Components and Server Actions, including UTF-16LE WAF evasion techniques.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC★ 1
Proof of Concept for Authenticated RCE in Crafty Controller <= 4.6.1
Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller
48RISCO
abrir ↗Metasploit600
ChurchCRM Unauthenticated RCE via Setup Page
ChurchCRM has unauthenticated RCE in its Install Wizard
43RISCO
abrir ↗GitHub PoC
React2shell vulnerable lab (CVE-2025-55182)
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗Metasploit300
ChurchCRM Database Restore RCE 6.2.0
ChurchCRM vulnerable to RCE with database restore functionality
43RISCO
abrir ↗GitHub PoC★ 6
Fortinet announced two closely related authentication‑bypass vulnerabilities on 9 December 2025. Both flaws involve improper verification of cryptographic signatures (CWE‑347) in the handling of SAML responses for the FortiCloud SSO login feature.
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0
90RISCO
abrir ↗local
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile
91RISCO
Exploit-DB
Summar Employee Portal 3.98.0 - Authenticated SQL Injection
SQL injection vulnerability in Summar Software´s Portal del Empleado
41RISCO
abrir ↗infoleak
Microsoft Windows File Explorer Spoofing Vulnerability
38RISCO
GitHub PoC★ 1
This is a python PoC scripts for CVE-2025-24071 which is a vulnerability in Windows File Explorer that allows unauthorized access to sensitive information like NTLM Exposure.
Microsoft Windows File Explorer Spoofing Vulnerability
38RISCO
abrir ↗GitHub PoC
CVE-2022-0492
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. Th
86RISCO
abrir ↗GitHub PoC
lytianahkone-boop/cve-2025-25257
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISCO
abrir ↗Metasploit600
HPE OneView unauthenticated RCE
A remote code execution issue exists in HPE OneView.
100RISCO
abrir ↗GitHub PoC★ 1
This repository documents three security vulnerabilities discovered in FreePBX (CVE-2025-66039, CVE-2025-61678, CVE-2025-61675), including analysis, impact, and proof-of-concept details for security research and awareness purposes.
FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header
63RISCO
abrir ↗GitHub PoC★ 1
A proof-of-concept tool for demonstrating the critical React2Shell vulnerability
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗Exploit-DB
esm-dev 136 - Path Traversal
esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header
48RISCO
abrir ↗initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
Metasploit600
Control Web Panel /admin/index.php Unauthenticated RCE
An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the "key" GET parameter to /
56RISCO
abrir ↗Metasploit600
FreeBSD rtsold/rtsol DNSSL Command Injection
Remote code execution via ND6 Router Advertisements
56RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e bases de inteligência de exploração. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.