Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
89.220exploits catalogados
41.197CVEs com exploração pública
24.696testados em laboratório
TodosReferência 26.738Exploit-DB 24.490GitHub PoC 18.525inteligência de exploração 11.299Nuclei 4.626Metasploit 3.542✓ só verificadosrecentespopularesrisco
89.220 exploits
GitHub PoC★ 3
A Chrome extension for detecting React2Shell vulnerabilities (CVE-2025-55182 & CVE-2025-66478) in web applications
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗initial-access
SPIP porte_plume Plugin Arbitrary PHP Execution
85RISCO
Metasploit600
FreePBX endpoint SQLi to RCE
FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parameters
48RISCO
abrir ↗GitHub PoC★ 2
Nkwenti-Severian-Ndongtsop/POC_react2shell_CVE-2025-55182
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC
Docker test environment for CVE-2025-34299 - Monsta FTP Pre-Auth RCE vulnerability
Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload
85RISCO
abrir ↗GitHub PoC★ 1
Burp Suite extension for identifying the React Server Components unsafe deserialization vulnerability (React2Shell / CVE-2025-55182). It provides a focused UI tab, context-menu actions, active-scanner integration, and optional Burp Collaborator confirmation.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗GitHub PoC★ 1
Exploitation of a Remote Code Execution vulnerability- (CVE-2024-7954)
SPIP porte_plume Plugin Arbitrary PHP Execution
85RISCO
abrir ↗GitHub PoC★ 3
Interactive visualization of the React2Shell (CVE-2025-55182) RCE vulnerability with narrated animations for three audiences: Expert, Practitioner, and Stakeholder. Audio synced via ElevenLabs + Whisper.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗Metasploit600
FreePBX firmware file upload
FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header
63RISCO
abrir ↗Metasploit600
FreePBX firmware file upload
FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter
48RISCO
abrir ↗GitHub PoC★ 5
This tool is a Proof of Concept (PoC) intended for security research and educational purposes only. Using this tool on systems without explicit permission is illegal and punishable by law. The author (Tiger-Foxx) assumes no responsibility for misuse.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗Metasploit300
FreePBX Custom Extension SQL Injection
FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header
63RISCO
abrir ↗Metasploit300
FreePBX Custom Extension SQL Injection
FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parameters
48RISCO
abrir ↗GitHub PoC
Apache Tomcat AJP Ghostcat (CVE-2020-1938) exploit tool for file disclosure with multi-target scanning, custom wordlists, and upload point detection capabilities
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc
100RISCO
abrir ↗GitHub PoC★ 2
CVE-2021-4045 CVE-2021-4045 is a Command Injection vulnerability that allows Remote Code Execution in the TP-Link Tapo c200 IP camera. It affects all firmware versions prior to 1.1.16 Build 211209 Rel. 37726N due to insufficient checks on user input in uhttpd, which is one of the main binaries of the device.
TP-LINK Tapo C200 remote code execution vulnerability
70RISCO
abrir ↗GitHub PoC★ 1
Educational / research tool related to React / Next.js vulnerability CVE‑2025‑55182 (“React2Shell”).
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
GitHub PoC
exrienz/CVE-2025-55182-NextJS-Scanner-React2Shell-PoC
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
GitHub PoC
CVE-2025-23061 - Mongoose Command Injection
Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NO
63RISCO
abrir ↗infoleak
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
remote-with-credentials
Windows SMB Client Elevation of Privilege Vulnerability
93RISCO
GitHub PoC
Legus-Yeung/CVE-2025-55182-exploit
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISCO
abrir ↗initial-access
ingress-nginx admission controller RCE escalation
85RISCO
initial-access
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISCO
GitHub PoC
Kubernetes Ingress-nginx RCE (IngressNightmare)
ingress-nginx admission controller RCE escalation
85RISCO
abrir ↗client-side
Microsoft Windows File Explorer Spoofing Vulnerability
38RISCO
Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e bases de inteligência de exploração. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.