Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
72.018exploits catalogados
32.219CVEs com exploração pública
1.932testados em laboratório
TodosExploit-DB 22.786Referência 20.023GitHub PoC 13.334VulnCheck XDB 8.195Nuclei 4.217Metasploit 3.463✓ só verificadosrecentespopularesrisco
13.307 exploits
GitHub PoC★ 1
PolarisXSec/CVE-2024-21413
Microsoft Outlook Remote Code Execution Vulnerability
100RISCO
abrir ↗GitHub PoC★ 1
fatkz/CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISCO
abrir ↗GitHub PoC
CVE-2025-0411 7-Zip Mark-of-the-Web Bypass
7-Zip Mark-of-the-Web Bypass Vulnerability
83RISCO
abrir ↗GitHub PoC
congdong007/CVE-2025-29306_poc
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.htm
75RISCO
abrir ↗GitHub PoC
Remote Code Execution (RCE) vulnerability in Apache Tomcat.
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISCO
abrir ↗GitHub PoC★ 1
Apache CXF SSRF CVE-2024-28752
Apache CXF SSRF Vulnerability using the Aegis databinding
63RISCO
abrir ↗GitHub PoC
PoC for CVE-2017-5487 - WordPress User Enumeration via REST
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before
45RISCO
abrir ↗GitHub PoC★ 3
Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function
Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function
48RISCO
abrir ↗GitHub PoC
SAP NetWeaver Visual Composer Metadata Uploader <= 7.50 CVE-2025-31324 PoC
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISCO
abrir ↗GitHub PoC★ 2
WordPress PDF 2 Post Plugin <= 2.4.0 is vulnerable to Remote Code Execution (RCE) +Subscriber
WordPress PDF 2 Post Plugin <= 2.4.0 - Remote Code Execution (RCE) vulnerability
53RISCO
abrir ↗GitHub PoC★ 2
WordPress Frontend Login and Registration Blocks Plugin <= 1.0.7 is vulnerable to Privilege Escalation
Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeover
63RISCO
abrir ↗GitHub PoC★ 8
exploit for CVE-2025-27533, a Denial of Service (DoS) vulnerability in Apache ActiveMQ
Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
33RISCO
abrir ↗GitHub PoC
Tools for scan CVE-2024-25600 - WordPress Bricks Builder Remote Code Execution (RCE)
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RISCO
abrir ↗GitHub PoC
CVE-2024-38475 Scanner using FFUF + Seclists
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
100RISCO
abrir ↗GitHub PoC
This is an exercise built around CVE-2021-3560
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile
91RISCO
abrir ↗GitHub PoC
The Web Is Vulnerable to CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
abrir ↗GitHub PoC★ 1
sap-netweaver-cve-2025-31324-check
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISCO
abrir ↗GitHub PoC
x-middleware exploit for next.js CVE-2023–46298 cache poisoning and CVE-2025-29927 bypass
Authorization Bypass in Next.js Middleware
85RISCO
abrir ↗GitHub PoC★ 8
NULLTRACE0X/CVE-2025-31324
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISCO
abrir ↗GitHub PoC★ 1
Exploitation report of the Samba Trans2Open vulnerability (CVE-2003-0201), including tools used, exploitation steps, and protection techniques to secure systems.
Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x vers
60RISCO
abrir ↗GitHub PoC
abrewer251/CVE-2024-38475_SonicBoom_Apache_URL_Traversal_PoC
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
100RISCO
abrir ↗GitHub PoC★ 2
exploiting CVE-2025-27007, a critical unauthenticated privilege escalation vulnerability in the OttoKit (formerly SureTriggers) WordPress plugin
WordPress SureTriggers <= 1.0.82 - Privilege Escalation Vulnerability
75RISCO
abrir ↗GitHub PoC
Vite WASM Import Path Traversal 🛡️
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
90RISCO
abrir ↗GitHub PoC★ 1
1Altruist/CVE-2025-46271-Reverse-Shell-PoC
Planet Technology Network Products OS Command Injection
48RISCO
abrir ↗GitHub PoC
NGINX DNS Overflow Vulnerability Check - CVE-2021-23017 PoC
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from t
35RISCO
abrir ↗GitHub PoC★ 1
Commvault Remote Code Execution (CVE-2025-34028) NSE
Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
100RISCO
abrir ↗GitHub PoC★ 2
Proof-of-Concept (PoC) for CVE-2025-34028, a Remote Code Execution vulnerability in Commvault Command Center. This Python script scans single or multiple targets, executes commands, and reports vulnerable hosts.
Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
100RISCO
abrir ↗GitHub PoC★ 1
PoC for CVE-2025-2011 - SQLi in Depicter plugin <= 3.6.1
Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter
68RISCO
abrir ↗GitHub PoC
Hirainsingadia/CVE-2002-2154
Directory traversal vulnerability in Monkey HTTP Daemon 0.1.4 allows remote attackers to read arbitrary files via .. (do
23RISCO
abrir ↗GitHub PoC
abrewer251/CVE-2025-1974_IngressNightmare_PoC
ingress-nginx admission controller RCE escalation
85RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.