Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.957exploits catalogados

32.195CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8.182Nuclei 4.217Metasploit 3.462✓ só verificadosrecentes populares risco

13.307 exploits

GitHub PoC★ 2

This repository includes the code and files needed to test and execute a PoC for CVE-2025-41656

CVE-2025-41656CRITICAL14 jul 2025

Pilz: Missing Authentication in Node-RED integration

53RISCO

abrir ↗

GitHub PoC★ 7

HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload

CVE-2025-7340CRITICAL14 jul 2025

HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload

48RISCO

abrir ↗

GitHub PoC

CVE-2025-29927 PoC | Auth Bypass Exploit | Python Tool using httpx | Middleware Vulnerability | Ethical Hacking Toolkit

CVE-2025-29927CRITICAL14 jul 2025

Authorization Bypass in Next.js Middleware

85RISCO

abrir ↗

GitHub PoC★ 2

Royal Elementor Addons - Unauthenticated Remote Code Execution

CVE-2023-5360—14 jul 2025

Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload

60RISCO

abrir ↗

GitHub PoC

Armand2002/Exploit-CVE-2025-1974-Lab

CVE-2025-1974CRITICAL14 jul 2025

ingress-nginx admission controller RCE escalation

85RISCO

abrir ↗

GitHub PoC

JayVillain/Scan-CVE-2025-6058

CVE-2025-6058CRITICAL13 jul 2025

WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload

63RISCO

abrir ↗

GitHub PoC

CVE-2025-32023

CVE-2025-32023HIGH13 jul 2025

Redis allows out of bounds writes in hyperloglog commands leading to RCE

41RISCO

abrir ↗

GitHub PoC

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

CVE-2025-31125MEDIUMsob ataque13 jul 2025

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

90RISCO

abrir ↗

GitHub PoC★ 8

Wazuh 8.4 CVE-2025-24016

CVE-2025-24016CRITICALsob ataque13 jul 2025

Remote code execution in Wazuh server

100RISCO

abrir ↗

GitHub PoC★ 2

🚀 Exploit for Moodle 4.4.0 Authenticated RCE (CVE-2024-43425) — run commands remotely ⚡

CVE-2024-43425HIGH13 jul 2025

Moodle: remote code execution via calculated question types

78RISCO

abrir ↗

GitHub PoC

This is a security assessment report regarding the EthernalBlue vulnerability (CVE-2017-0143).

CVE-2017-0143HIGHsob ataqueransomware13 jul 2025

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISCO

abrir ↗

GitHub PoC★ 14

A detailed walkthrough of TryHackMe's Billing room exploiting CVE-2023-30258 and escalating via fail2ban misconfig

CVE-2023-30258CRITICAL13 jul 2025

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary com

85RISCO

abrir ↗

GitHub PoC

CVE-2020-35848 impacts Cockpit-CMS v1.7 due to unsafe handling of user inputs in authentication mechanisms, leading to remote code execution. This lab is built for CTF players and bug bounty learners to simulate real-world exploitation workflows including token extraction, password reset, and flag capture.

CVE-2020-35848—13 jul 2025

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.

60RISCO

abrir ↗

GitHub PoC★ 1

Python exploit for vsftpd 2.3.4 - Backdoor Command Execution

CVE-2011-2523—12 jul 2025

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RISCO

abrir ↗

GitHub PoC★ 1

imbas007/CVE-2025-25257

CVE-2025-25257CRITICALsob ataque12 jul 2025

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi

100RISCO

abrir ↗

GitHub PoC

Proof of Concept for CVE-2025-24813, a Remote Code Execution vulnerability in Apache Tomcat. This PoC exploits unsafe deserialization via crafted session files uploaded through HTTP PUT requests, allowing attackers to execute arbitrary code remotely on vulnerable Tomcat servers.

CVE-2025-24813CRITICALsob ataque12 jul 2025

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RISCO

abrir ↗

GitHub PoC

Tool for detecting and exploiting CVE-2025-25257 in Fortinet FortiWeb.

CVE-2025-25257CRITICALsob ataque12 jul 2025

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi

100RISCO

abrir ↗

GitHub PoC★ 1

Exploiting the CVE-2025-25257 vulnerability in FortiWeb. This repository demonstrates secure pre-authenticated SQL injection.

CVE-2025-25257CRITICALsob ataque12 jul 2025

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi

100RISCO

abrir ↗

GitHub PoC

r0otk3r/CVE-2024-1212

CVE-2024-1212CRITICALsob ataque12 jul 2025

LoadMaster Pre-Authenticated OS Command Injection

100RISCO

abrir ↗

GitHub PoC

r0otk3r/CVE-2022-1388

CVE-2022-1388CRITICALsob ataqueransomware12 jul 2025

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RISCO

abrir ↗

GitHub PoC

WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload

CVE-2025-6058CRITICAL12 jul 2025

WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload

63RISCO

abrir ↗

GitHub PoC

pkblanks/Remediating-CVE-2013-3900-EnableCertPaddingCheck-

CVE-2013-3900MEDIUMsob ataque12 jul 2025

WinVerifyTrust Signature Validation Vulnerability

75RISCO

abrir ↗

GitHub PoC

MacUchegit/Detecting-and-Analyzing-CVE-2024-24919-Exploitation

CVE-2024-24919HIGHsob ataqueransomware12 jul 2025

Information disclosure

100RISCO

abrir ↗

GitHub PoC

r0otk3r/CVE-2024-10915

CVE-2024-10915CRITICAL11 jul 2025

D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

85RISCO

abrir ↗

GitHub PoC

Rust PoC for CVE-2025-32463 (sudo chroot "chwoot" Local PrivEsc)

CVE-2025-32463CRITICALsob ataque11 jul 2025

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RISCO

abrir ↗

GitHub PoC

Documentation for CVE-2025-6514. MCP-Remote RCE.

CVE-2025-6514CRITICAL11 jul 2025

OS command injection in mcp-remote when connecting to untrusted MCP servers

70RISCO

abrir ↗

GitHub PoC

just remeber how small mistake in santisize username could give yoy root access to the full machine

CVE-2007-2447—11 jul 2025

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands

50RISCO

abrir ↗

GitHub PoC

Metasploit module for MailEnable CVE-2022-36934 authentication bypass RCE

CVE-2022-36934CRITICAL11 jul 2025

An integer overflow in WhatsApp could result in remote code execution in an established video call.

48RISCO

abrir ↗

GitHub PoC

Critical Sudo Vulnerabilities Let Local Users Gain Root Access on Linux, Impacting Major Distros

CVE-2025-32462LOW11 jul 2025

Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allo

28RISCO

abrir ↗

GitHub PoC

hackmelocal/CVE-2025-49113-Simulation

CVE-2025-49113CRITICALsob ataque11 jul 2025

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the

100RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.