Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
75.652exploits catalogados
34.545CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.443Referência 21.581GitHub PoC 13.708VulnCheck XDB 8.225Nuclei 4.228Metasploit 3.467✓ só verificadosrecentespopularesrisco
75.652 exploits
GitHub PoC
shoucheng3/apache__myfaces_CVE-2011-4367_2-0-11
Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.1
35RISCO
abrir ↗GitHub PoC
shoucheng3/xwiki__xwiki-rendering_CVE-2023-37908_14-10-3
org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability
48RISCO
abrir ↗GitHub PoC★ 5
CVE-2025-6934 is a critical vulnerability in the WordPress Opal Estate Pro plugin (<= 1.7.5) that allows unauthenticated attackers to create new administrator accounts through the plugin’s insecure AJAX registration process.
Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'
68RISCO
abrir ↗GitHub PoC★ 1
Exploit for CVE-2018-7422: Local File Inclusion in WordPress Plugin Site Editor 1.1.1 [T1574.008]
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to re
50RISCO
abrir ↗VulnCheck XDB
infoleak
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to re
50RISCO
abrir ↗GitHub PoC
shoucheng3/apache__shiro_CVE-2023-34478_1-11-0
Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.
48RISCO
abrir ↗GitHub PoC
shoucheng3/apache__rocketmq_CVE-2023-37582_4-9-6
Apache RocketMQ: Possible remote code execution when using the update configuration function
85RISCO
abrir ↗GitHub PoC
Research Objective: To conduct a comprehensive analysis and successful exploitation of a Remote Code Execution (RCE) vulnerability in Webmin version 1.890 (CVE-2019-15107), ultimately gaining full control over the target system.
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RISCO
abrir ↗VulnCheck XDB
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISCO
abrir ↗GitHub PoC★ 36
Exploit systems using older WinRAR without knowing their username (unlike other projects)
Path traversal vulnerability in WinRAR
93RISCO
abrir ↗GitHub PoC★ 1
Ash1996x/CVE-2025-50154-Aggressor-Script
Microsoft Windows File Explorer Spoofing Vulnerability
38RISCO
abrir ↗VulnCheck XDB
initial-access
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
75RISCO
abrir ↗GitHub PoC★ 1
0xAbolfazl/CVE-2025-8088-WinRAR-PathTraversal-PoC
Path traversal vulnerability in WinRAR
93RISCO
abrir ↗GitHub PoC★ 4
Safe Python script to detect Cisco FMC instances potentially vulnerable to CVE-2025-20265. Uses official FMC API to check version, supports single/multi-target scanning, and includes a harmless local PoC marker.
Cisco Secure Firewall Management Center Software Radius Remote Code Execution Vulnerability
53RISCO
abrir ↗GitHub PoC★ 4
A PoC for CVE-2024-3660. Arbitrary Code Execution in Keras.
Arbitrary code injection vulnerability in Keras framework < 2.13
48RISCO
abrir ↗VulnCheck XDB
initial-access
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISCO
abrir ↗GitHub PoC
hlc23/CVE-2024-5932-web-ui
GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution
85RISCO
abrir ↗GitHub PoC★ 1
0xr2r/CVE-2017-11317-auto-exploit-
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload
100RISCO
abrir ↗VulnCheck XDB
initial-access
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authen
50RISCO
abrir ↗GitHub PoC★ 110
PoC and technical details of CVE-2025-24204
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access pr
48RISCO
abrir ↗GitHub PoC★ 2
MailPoet Newsletters <= Arbitrary File Upload (exploiter)
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authen
50RISCO
abrir ↗GitHub PoC★ 22
sap netweaver 0day poc by shinyhunters (scattered lapsus$ hunters) affecting all 7.x CVE-2025-31324
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISCO
abrir ↗GitHub PoC
Exploration of the Follina (CVE-2022-30190) Microsoft Office vulnerability, including a detailed analysis, proof-of-concept exploitation in a controlled lab, and mitigation strategies. For educational and research purposes only.
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISCO
abrir ↗VulnCheck XDB
initial-access
XXE can expose crypt key and other secrets granting full admin access
100RISCO
abrir ↗GitHub PoC★ 1
okkotsu1/CVE-2024-47533
Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes
63RISCO
abrir ↗GitHub PoC★ 56
Advanced WinRAR Path Traversal Exploit Tool for CVE-2025-8088
Path traversal vulnerability in WinRAR
93RISCO
abrir ↗VulnCheck XDB
infoleak
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.