Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.760exploits catalogados

32.083CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 19.934GitHub PoC 13.235VulnCheck XDB 8.150Nuclei 4.193Metasploit 3.462✓ só verificadosrecentes populares risco

13.235 exploits

GitHub PoC★ 13

Unauthenticated authentication bypass to RCE exploit for CVE-2024-10924. Abuses an authentication and 2FA bypass in the Really Simple Security WordPress plugin to impersonate an admin user, upload a malicious plugin, and achieve remote command execution via an interactive shell.

CVE-2024-10924CRITICAL22 jan 2026

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

85RISCO

GitHub PoC★ 1

Unauthenticated 0-click RCE exploit for CVE-2023-51409. Abuses an arbitrary file upload flaw in the AI Engine WordPress plugin to upload a PHP webshell and achieve remote command execution without authentication, including OS detection and an interactive shell.

CVE-2023-51409CRITICAL22 jan 2026

WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability

75RISCO

GitHub PoC★ 1

Exploit for CVE-2023-40028 (for educational purposes)

CVE-2023-40028MEDIUM22 jan 2026

Arbitrary file read via symlinks in Ghost

45RISCO

GitHub PoC★ 2

Unauthenticated 0-click RCE exploit for CVE-2024-9932. Exploits an arbitrary file upload vulnerability in the Wux Blog Editor WordPress plugin to upload a remote PHP payload, detect the target operating system, and achieve remote command execution through an interactive web shell.

CVE-2024-9932CRITICAL22 jan 2026

Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

60RISCO

GitHub PoC

Relatório TryHackMe — n8n CVE-2025-68613 (CVSS 9.9)

CVE-2025-68613CRITICALsob ataque22 jan 2026

n8n Vulnerable to Remote Code Execution via Expression Injection

100RISCO

GitHub PoC★ 1

A hands-on project demonstrating the setup of virtual security lab, network reconnaissance, and exploitation of CVE-2012-1823.

CVE-2012-1823CRITICALsob ataque22 jan 2026

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

100RISCO

GitHub PoC★ 1

Unauthenticated 0-click RCE exploit for CVE-2024-51793. Exploits an arbitrary file upload vulnerability via admin-ajax.php to upload a PHP payload and achieve remote command execution on vulnerable WordPress installations, including OS detection and an interactive command shell.

CVE-2024-51793CRITICAL22 jan 2026

WordPress RepairBuddy plugin <= 3.8115 - Arbitrary File Upload vulnerability

48RISCO

GitHub PoC★ 2

CVE-2025-55182

CVE-2025-55182CRITICALsob ataqueransomware22 jan 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

GitHub PoC

React Router's createFileSessionStorage() in certain versions allows unsigned cookies to be manipulated, enabling file system access outside the session directory.

CVE-2025-61686CRITICAL21 jan 2026

React Router has Path Traversal in File Session Storage

53RISCO

GitHub PoC★ 2

This Poc demonstrate Arbitrary read/write primitives provided by CVE-2025-7771

CVE-2025-7771HIGH21 jan 2026

Code Execution / Escalation of Privileges in ThrottleStop

41RISCO

GitHub PoC

abanop22333/Apache-Authentication-Flaw-Research-CVE-2024-38476-

CVE-2024-38476CRITICAL21 jan 2026

Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect

60RISCO

GitHub PoC

SMBv1: CVE-2017-0143, gravedad 8.8, de ejecucion remota de codigo (RCE), en Windows con SMBv1 (ms17-010)

CVE-2017-0143HIGHsob ataqueransomware21 jan 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISCO

GitHub PoC

nimesh895/Malware-Analysis-Follina-CVE-2022-30190

CVE-2022-30190HIGHsob ataqueransomware21 jan 2026

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

100RISCO

GitHub PoC★ 1

Final Project in Fundamental network security,POC CVE-202438063

CVE-2024-38063CRITICAL21 jan 2026

Windows TCP/IP Remote Code Execution Vulnerability

70RISCO

GitHub PoC

CybersRMUTL/CVE-2019-9193-Postgresql-RCE

CVE-2019-9193—21 jan 2026

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve

60RISCO

GitHub PoC

afifudinmtop/CVE-2021-21425

CVE-2021-21425CRITICAL21 jan 2026

Unauthenticated Arbitrary YAML Write/Update leads to Code Execution

85RISCO

GitHub PoC★ 1

InfoSecAntara/CVE-2025-14847-MongoDB

CVE-2025-14847HIGHsob ataque21 jan 2026

Zlib compressed protocol header length confusion may allow memory read

100RISCO

GitHub PoC

CybersRMUTL/CVE-2019-10149-Exim4-RCE

CVE-2019-10149CRITICALsob ataque21 jan 2026

A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message(

100RISCO

GitHub PoC

MOVEit Transfer 2023 mass data breach (CVE-2023-34362)

CVE-2023-34362CRITICALsob ataqueransomware21 jan 2026

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.

100RISCO

GitHub PoC★ 2

海康威视RCE漏洞批量检测和利用工具

CVE-2021-36260CRITICALsob ataque21 jan 2026

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

100RISCO

GitHub PoC★ 1

CVE-2017-7921, CVE-2021-36260 updated 21/01/2026

CVE-2017-7921CRITICALsob ataque21 jan 2026

An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16

100RISCO

GitHub PoC★ 1

CVE-2017-7921, CVE-2021-36260 updated 21/01/2026

CVE-2021-36260CRITICALsob ataque21 jan 2026

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

100RISCO

GitHub PoC

Vladjrfhfg/React-site-CVE-2025-55182

CVE-2025-55182CRITICALsob ataqueransomware20 jan 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

GitHub PoC

CVE-2025-55182(命令执行、反弹shell、注入内存马)

CVE-2025-55182CRITICALsob ataqueransomware20 jan 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

GitHub PoC

dragosbanica/CVE-2023-0386_POC

CVE-2023-0386HIGHsob ataque20 jan 2026

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities wa

86RISCO

GitHub PoC

CVE-2025-55182 React Server Components Remote Code Execution Exploit Lab

CVE-2025-55182CRITICALsob ataqueransomware20 jan 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

GitHub PoC

Spring4Shell (CVE-2022-22965) DFIR lab with exploit simulation, Python WAF, IOC-based detection, and PCAP analysis.

CVE-2022-22965CRITICALsob ataque20 jan 2026

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISCO

GitHub PoC

vsftpd 2.3.4 (CVE-2011-2523) a critical vulnerability that leads to Reverse Root Shell. In this repo I will do a PoC how to exploit it step by step, Manually & Automatically (Python) for educational purposes.

CVE-2011-2523—20 jan 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RISCO

GitHub PoC

This script is used to identify MongoDB services that are network-exposed and allow unauthenticated protocol handshakes.

CVE-2025-14847HIGHsob ataque20 jan 2026

Zlib compressed protocol header length confusion may allow memory read

100RISCO

GitHub PoC★ 5

A tool designed to exploit CVE-2025-54068 and Remote Command Execution of the Livewire project.

CVE-2025-54068CRITICALsob ataque20 jan 2026

Livewire vulnerable to remote command execution during property update hydration

100RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.