Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
76.053exploits catalogados
34.675CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.443Referência 21.692GitHub PoC 13.758VulnCheck XDB 8.460Nuclei 4.233Metasploit 3.467✓ só verificadosrecentespopularesrisco
75.902 exploits
GitHub PoC★ 1
Erlang/OTP SSH 远程代码执行漏洞
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISCO
abrir ↗GitHub PoC
Grand-Moomin/Vuln-Next.js-CVE-2025-29927
Authorization Bypass in Next.js Middleware
85RISCO
abrir ↗Exploit-DB
Inventio Lite 4 - SQL Injection
evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action
48RISCO
abrir ↗GitHub PoC★ 5
CVE-2025-24813的vulhub环境的POC脚本
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISCO
abrir ↗GitHub PoC★ 3
Missing Authentication for Critical Function (CWE-306)-Exploit
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISCO
abrir ↗Exploit-DB
compop.ca 3.5.3 - Arbitrary code Execution
An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and t
48RISCO
abrir ↗Exploit-DB
Usermin 2.100 - Username Enumeration
A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid
48RISCO
abrir ↗Exploit-DB
Angular-Base64-Upload Library 0.1.21 - Unauthenticated Remote Code Execution (RCE)
angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Explo
75RISCO
abrir ↗Exploit-DB
TP-Link VN020 F3v(T) TT_V6.2.1021 - Buffer Overflow Memory Corruption
TP-Link VN020 F3v(T) FTP USER Command memory corruption
33RISCO
abrir ↗GitHub PoC★ 4
exploit script for CVE-2024-45436
extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent direct
48RISCO
abrir ↗Exploit-DB
Blood Bank & Donor Management System 2.4 - CSRF Improper Input Validation
PHPGurukul Blood Bank & Donor Management System logout.php cross-site request forgery
33RISCO
abrir ↗GitHub PoC
NGINX Security Hardening & Vulnerability Remediation Analysis of critical CVEs (CVE-2021-23017, HTTP/2 DoS flaws) in outdated NGINX versions, with actionable steps for mitigation: upgrades, HTTP/2 hardening, and patch automation. Includes Nessus scan validation and proactive monitoring strategies.
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from t
35RISCO
abrir ↗Exploit-DB
TP-Link VN020 F3v(T) TT_V6.2.1021 - Denial Of Service (DOS)
TP-Link VN020 F3v(T) Incomplete SOAP Request WANIPConnection denial of service
41RISCO
abrir ↗GitHub PoC★ 1
ethicalPap/CVE-2025-29775
xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment
48RISCO
abrir ↗Exploit-DB
ABB Cylon Aspect 3.08.02 (deployStart.php) - Unauthenticated Command Execution
Unauthorized Access
48RISCO
abrir ↗VulnCheck XDB
initial-access
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.htm
75RISCO
abrir ↗GitHub PoC★ 2
verylazytech/CVE-2025-29306
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.htm
75RISCO
abrir ↗VulnCheck XDB
initial-access
Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
100RISCO
abrir ↗VulnCheck XDB
infoleak
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baske
48RISCO
abrir ↗VulnCheck XDB
infoleak
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
100RISCO
abrir ↗Exploit-DB
NagVis 1.9.33 - Arbitrary File Read
Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagV
48RISCO
abrir ↗Exploit-DB
Smart Manager 8.27.0 - Post-Authenticated SQL Injection
Smart Manager < 8.28.0 - Admin+ SQL Injection
41RISCO
abrir ↗VulnCheck XDB
local
An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle o
98RISCO
abrir ↗VulnCheck XDB
initial-access
GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not
50RISCO
abrir ↗GitHub PoC★ 1
This is a proof of concept of the critical WinBox vulnerability (CVE-2018-14847) which allows for arbitrary file read of plain text passwords. The vulnerability has long since been fixed, so this project has ended and will not be supported or updated anymore. You can fork it and update it yourself instead.
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
100RISCO
abrir ↗Exploit-DB
phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting (XSS)
Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
48RISCO
abrir ↗GitHub PoC
enochgitgamefied/NextJS-CVE-2025-29927
Authorization Bypass in Next.js Middleware
85RISCO
abrir ↗Exploit-DB
ABB Cylon Aspect 3.08.02 - Cross-Site Request Forgery (CSRF)
Cross Side Request Forgery, CSRF
41RISCO
abrir ↗Exploit-DB
phpMyFAQ 3.2.10 - Unintended File Download Triggered by Embedded Frames
phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames
33RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.