Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

71.836exploits catalogados

32.133CVEs com exploração pública

1.932testados em laboratório

Todos Exploit-DB 22.786Referência 19.967GitHub PoC 13.264VulnCheck XDB 8.156Nuclei 4.201Metasploit 3.462✓ só verificadosrecentes populares risco

13.264 exploits

GitHub PoC

Looking at current high-impact vulnerabilities, let's use the VMware vCenter Server CVE-2021-21972 (CVSS 9.8) as our base. This is a publicly known RCE with patches available, perfect for demonstrating CTT enhancements.

CVE-2021-21972CRITICALsob ataqueransomware27 jan 2026

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor

100RISCO

GitHub PoC

An advanced exploit for Microsoft Exchange Server (CVE-2021-26855, CVE-2021-27065) enhanced with Convergent Time Theory principles, achieving near-perfect theoretical rating through quantum temporal resonance and α-dispersion techniques.

CVE-2021-26855CRITICALsob ataqueransomware27 jan 2026

Microsoft Exchange Server Remote Code Execution Vulnerability

100RISCO

GitHub PoC★ 1

0xLittleSpidy/CVE-2025-54309

CVE-2025-54309CRITICALsob ataque27 jan 2026

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and

100RISCO

GitHub PoC

Sn0wBaall/CVE-2024-23334-PoC

CVE-2024-23334MEDIUM27 jan 2026

aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

70RISCO

GitHub PoC

Simple and effective PoC for CVE-2021-43798 Grafana Path Traversal

CVE-2021-43798HIGHsob ataque27 jan 2026

Grafana path traversal

100RISCO

GitHub PoC

Spring Cloud Gateway SpEL RCE Vulnerability Environment

CVE-2025-41243CRITICAL26 jan 2026

Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux

63RISCO

GitHub PoC

afifudinmtop/CVE-2009-3103

CVE-2009-3103—26 jan 2026

Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Window

60RISCO

GitHub PoC

CVE-2025-24893 | Vulnérabilité d'exécution de code à distance sur la plateforme XWiki (preuve de concept)

CVE-2025-24893CRITICALsob ataque26 jan 2026

Remote code execution as guest via SolrSearchMacros request in xwiki

100RISCO

GitHub PoC★ 1

A Proof of Concept for CVE-2025-29927 demonstrating a middleware bypass in Next.js versions prior to 13.5.9

CVE-2025-29927CRITICAL26 jan 2026

Authorization Bypass in Next.js Middleware

85RISCO

GitHub PoC

🔍 Analyze WebKit and ANGLE vulnerabilities with this repository for CVE-2025-43529 and CVE-2025-14174, focusing on verified components and ongoing efforts.

CVE-2025-43529HIGHsob ataque26 jan 2026

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and

71RISCO

GitHub PoC

CVE-2025-64155

CVE-2025-64155CRITICAL25 jan 2026

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet

60RISCO

GitHub PoC★ 4

POC (RCE) -> CVE-2019-9978

CVE-2019-9978MEDIUMsob ataque25 jan 2026

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio

100RISCO

GitHub PoC

dionissh/CVE-2024-21413

CVE-2024-21413CRITICALsob ataque25 jan 2026

Microsoft Outlook Remote Code Execution Vulnerability

100RISCO

GitHub PoC

CVE-2025-60021

CVE-2025-60021CRITICAL25 jan 2026

Apache bRPC: Remote command injection vulnerability in heap builtin service

53RISCO

GitHub PoC

Python demo simulating CVE-2024-3094: a supply chain backdoor in XZ Utils with a trigger-based stealth activation.

CVE-2024-3094CRITICAL25 jan 2026

Xz: malicious code in distributed source

70RISCO

GitHub PoC★ 2

CVE-2015-2291 Local Privilege Escalation PoC

CVE-2015-2291HIGHsob ataqueransomware25 jan 2026

(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows all

71RISCO

GitHub PoC

jagg3rsec/CVE-2014-6287

CVE-2014-6287CRITICALsob ataque25 jan 2026

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a

100RISCO

GitHub PoC

Baza-NATO/CVE-2021-33044

CVE-2021-33044CRITICALsob ataque25 jan 2026

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can by

100RISCO

GitHub PoC

For HTB practice

CVE-2022-44268MEDIUM24 jan 2026

ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulti

55RISCO

GitHub PoC

ranasen-rat/cve-2021-42013

CVE-2021-42013CRITICALsob ataqueransomware24 jan 2026

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RISCO

GitHub PoC

xitexploiter96-dot/CVE-2023-38408

CVE-2023-38408CRITICAL24 jan 2026

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remot

70RISCO

GitHub PoC★ 1

A secure, zero-trust database management tool for WordPress. Fixes critical SSRF vulnerabilities (CVE-2021-21311) by enforcing local connections only.

CVE-2021-21311HIGHsob ataque24 jan 2026

SSRF in adminer

100RISCO

GitHub PoC

CVE-2025-52691 PoC: Based on watchtowr's article WT-2026-0001 about an authentication bypass exploit, this one is a functional Python attack script.

CVE-2025-52691CRITICALsob ataqueransomware23 jan 2026

Upload Arbitrary Files

100RISCO

GitHub PoC★ 2

Sairbo/Unihackers---CVE-2025-55182-

CVE-2025-55182CRITICALsob ataqueransomware23 jan 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

GitHub PoC

Replica of CVE-2019-15715 in Python3

CVE-2019-15715—23 jan 2026

MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.

35RISCO

GitHub PoC★ 2

The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via the `kubio_hybrid_theme_load_template` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files..

CVE-2025-2294CRITICAL23 jan 2026

Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion

85RISCO

GitHub PoC★ 2

CVE-2025-55182

CVE-2025-55182CRITICALsob ataqueransomware22 jan 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISCO

GitHub PoC★ 1

A hands-on project demonstrating the setup of virtual security lab, network reconnaissance, and exploitation of CVE-2012-1823.

CVE-2012-1823CRITICALsob ataque22 jan 2026

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

100RISCO

GitHub PoC★ 1

Unauthenticated 0-click RCE exploit for CVE-2023-51409. Abuses an arbitrary file upload flaw in the AI Engine WordPress plugin to upload a PHP webshell and achieve remote command execution without authentication, including OS detection and an interactive shell.

CVE-2023-51409CRITICAL22 jan 2026

WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability

75RISCO

GitHub PoC★ 1

Unauthenticated 0-click RCE exploit for CVE-2024-51793. Exploits an arbitrary file upload vulnerability via admin-ajax.php to upload a PHP payload and achieve remote command execution on vulnerable WordPress installations, including OS detection and an interactive command shell.

CVE-2024-51793CRITICAL22 jan 2026

WordPress RepairBuddy plugin <= 3.8115 - Arbitrary File Upload vulnerability

48RISCO

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.