Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
72.018exploits catalogados
32.219CVEs com exploração pública
1.932testados em laboratório
TodosExploit-DB 22.786Referência 20.023GitHub PoC 13.334VulnCheck XDB 8.195Nuclei 4.217Metasploit 3.463✓ só verificadosrecentespopularesrisco
13.334 exploits
GitHub PoC★ 7
This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It abuses the getDefaultValue() mechanism to instantiate arbitrary record types during parsing, enabling code execution when untrusted data is processed without proper controls.
Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata
60RISCO
abrir ↗GitHub PoC★ 1
YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.
Path Traversal allowing arbitrary read of files in Yeswiki
56RISCO
abrir ↗GitHub PoC★ 12
PoC
Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata
60RISCO
abrir ↗GitHub PoC★ 7
CVE-2025-30208 - Vite Arbitrary File Read PoC
Vite bypasses server.fs.deny when using `?raw??`
70RISCO
abrir ↗GitHub PoC★ 1
h4ckxel/CVE-2025-2005
Front-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Upload
53RISCO
abrir ↗GitHub PoC
Next.js Middleware Authorization Bypass Tool (CVE-2025-29927)
Authorization Bypass in Next.js Middleware
85RISCO
abrir ↗GitHub PoC
Mongo Vulnub Lab...Try to Hack IT.....!
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.
63RISCO
abrir ↗GitHub PoC
A demo exploit for CVE-2021-44026, a SQL injection in Roundcube
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
90RISCO
abrir ↗GitHub PoC
corsisechero/CVE-2019-9193byVulHub
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
60RISCO
abrir ↗GitHub PoC★ 2
Detection of malicious VHD files for CVE-2025-24985
Windows Fast FAT File System Driver Remote Code Execution Vulnerability
71RISCO
abrir ↗GitHub PoC★ 9
WordPress Front End Users Plugin <= 3.2.32 is vulnerable to Arbitrary File Upload
Front-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Upload
53RISCO
abrir ↗GitHub PoC
Next.js and the corrupt middleware...TRY TO HACK IT..!
Authorization Bypass in Next.js Middleware
85RISCO
abrir ↗GitHub PoC★ 1
mass scan for CVE-2025-30208
Vite bypasses server.fs.deny when using `?raw??`
70RISCO
abrir ↗GitHub PoC
A basic proof of concept of the CVE-2025-29927 vulnerability that allows to bypass the middleware scripts.
Authorization Bypass in Next.js Middleware
85RISCO
abrir ↗GitHub PoC
User Registration & Membership <= 4.1.2 - Authentication Bypass
User Registration & Membership < 4.1.3 - Authentication Bypass
41RISCO
abrir ↗GitHub PoC★ 1
Next.js Middleware Bypass Vulnerability
Authorization Bypass in Next.js Middleware
85RISCO
abrir ↗GitHub PoC
DeividasTerechovas/SOC227-Microsoft-SharePoint-Server-Elevation-of-Privilege-Possible-CVE-2023-29357-Exploitation
Microsoft SharePoint Server Elevation of Privilege Vulnerability
100RISCO
abrir ↗GitHub PoC
Next.js CVE-2025-29927 güvenlik açığı hakkında
Authorization Bypass in Next.js Middleware
85RISCO
abrir ↗GitHub PoC
Authorization Bypass in Next.js Middleware
Authorization Bypass in Next.js Middleware
85RISCO
abrir ↗GitHub PoC
congdong007/CVE-2024-50623-poc
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file up
100RISCO
abrir ↗GitHub PoC★ 1
SAPGateBreaker is a PoC exploit for CVE-2022-22536, a critical HTTP Request Smuggling vulnerability in SAP NetWeaver. It demonstrates how to bypass ACLs by desynchronizing request parsing between ICM and backend services using crafted Content-Length-based payloads.
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and
100RISCO
abrir ↗GitHub PoC★ 6
Vite 任意文件读取漏洞POC
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
90RISCO
abrir ↗GitHub PoC
backdoor.mirai.helloworld cve2018-20561, cve-2018-10562 해킹
An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_ac
100RISCO
abrir ↗GitHub PoC★ 13
Unauthenticated RCE exploit for CVE-2024-25600 in WordPress Bricks Builder <= 1.9.6. Executes arbitrary code remotely.
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RISCO
abrir ↗GitHub PoC
mrrivaldo/CVE-2025-2294
Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion
85RISCO
abrir ↗GitHub PoC
Unauthenticated SQL injection exploit for CVE-2019-9053 in CMS Made Simple <= 2.2.9. Extracts admin creds with time-based SQLi.
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve
35RISCO
abrir ↗GitHub PoC★ 7
针对CVE-2025-30208和CVE-2025-31125的漏洞利用
Vite bypasses server.fs.deny when using `?raw??`
70RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.