Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
75.526exploits catalogados
34.478CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.443Referência 21.534GitHub PoC 13.654VulnCheck XDB 8.213Nuclei 4.218Metasploit 3.464✓ só verificadosrecentespopularesrisco
13.648 exploits
GitHub PoC
shanglyu/CVE-2024-1698
NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection
85RISCO
abrir ↗GitHub PoC
kkhackz0013/CVE-2024-36401
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
100RISCO
abrir ↗GitHub PoC
a proof of concept of the CVE-2024-27198 which infect jetbrains teamCity
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
100RISCO
abrir ↗GitHub PoC
Gilospy/CVE-2022-26134
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
100RISCO
abrir ↗GitHub PoC★ 1
PoC for RCE in SQLPad (CVE-2022-0944)
Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad
48RISCO
abrir ↗GitHub PoC
lemonadern/poc-cve-2019-14287
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and se
35RISCO
abrir ↗GitHub PoC★ 2
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'
68RISCO
abrir ↗GitHub PoC
intel365/CVE-2024-7593
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remo
100RISCO
abrir ↗GitHub PoC★ 1
CVE-2021-40539：ADSelfService Plus RCE漏洞
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resulta
100RISCO
abrir ↗GitHub PoC
CVE-2021-40539：ADSelfService Plus RCE漏洞
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resulta
100RISCO
abrir ↗GitHub PoC★ 1
OxLmahdi/cve-2024-5932
GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution
85RISCO
abrir ↗GitHub PoC★ 1
Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
63RISCO
abrir ↗GitHub PoC★ 1
test_private_CVE
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.
90RISCO
abrir ↗GitHub PoC
Checkpoint SQL Injection via Time-Based Attack (CVE-2024-9465)
Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure
100RISCO
abrir ↗GitHub PoC★ 2
intel365/CVE-2024-29973
** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmwar
85RISCO
abrir ↗GitHub PoC★ 5
is a PoC tool designed to exploit insecurely exposed debug logs from WordPress sites and extract session cookies
WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability
85RISCO
abrir ↗GitHub PoC★ 6
p33d/CVE-2024-9441
Linear eMerge e3-Series Forgot Password Command Injection
60RISCO
abrir ↗GitHub PoC★ 31
Proof of Concept Exploit for CVE-2024-9465
Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure
100RISCO
abrir ↗GitHub PoC★ 17
CVE-2024-38077: Remote Code Execution Vulnerability in Windows Remote Desktop Licensing Service
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
70RISCO
abrir ↗GitHub PoC★ 27
Unauthenticated Remote Code Execution via Angular-Base64-Upload Library
angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Explo
75RISCO
abrir ↗GitHub PoC★ 2
intel365/CVE-2024-2876
Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection
85RISCO
abrir ↗GitHub PoC★ 44
Proof of Concept Exploit for CVE-2024-9464
Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure
70RISCO
abrir ↗GitHub PoC★ 3
is a PoC tool that targets a vulnerability in the TeamCity server (CVE-2024-27198)
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
100RISCO
abrir ↗GitHub PoC
The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to, and including, 9.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attac
Booking Calendar <= 9.9 - Unauthenticated SQL Injection
48RISCO
abrir ↗GitHub PoC★ 1
Proof of Concept for the Log4Shell vulnerability (CVE-2021-44228), developed as part of the coursework for the curricular unit TPAS in the Master's degree in Information Security at FCUP.
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISCO
abrir ↗GitHub PoC
bka/magento-cve-2024-34102-exploit-cosmicstring
XXE can expose crypt key and other secrets granting full admin access
100RISCO
abrir ↗GitHub PoC
wargame, CVE-2024-4367
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RISCO
abrir ↗GitHub PoC★ 1
Performs an IPv6 vulnerability scan and packet flood attack on specified targets. The script simulates a SYN flood and ICMP flood attack and optionally sends exploit packets.
Windows TCP/IP Remote Code Execution Vulnerability
70RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.