Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.886exploits catalogados

32.153CVEs con explotación pública

1932probados en laboratorio

Todos Exploit-DB 22.786Referência 19.978GitHub PoC 13.282VulnCheck XDB 8176Nuclei 4202Metasploit 3462✓ solo verificadosrecientes populares riesgo

71.886 exploits

GitHub PoC

This repository provides production-ready detection engineering content for **CVE-2025-25257**, a pre-authentication SQL Injection vulnerability in Fortinet FortiWeb Fabric Connector versions 7.0 through 7.6.x. Successful exploitation can lead to Remote Code Execution without any prior authentication.

CVE-2025-25257CRITICALbajo ataque01 mar 2026

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi

100RIESGO

GitHub PoC

Black box penetration test — WordPress exploitation, privilege escalation via CVE-2022-0847

CVE-2022-0847HIGHbajo ataque01 mar 2026

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RIESGO

GitHub PoC

CVE-2022-22965

CVE-2022-22965CRITICALbajo ataque01 mar 2026

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RIESGO

GitHub PoC

Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation

CVE-2021-4034HIGHbajo ataque01 mar 2026

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RIESGO

GitHub PoC

Controlled penetration testing lab demonstrating CVE-2011-2523 exploitation and mitigation techniques.

CVE-2011-2523—28 feb 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

GitHub PoC★ 1

Authenticated remote code execution in Pluck CMS before 4.7.13.

CVE-2020-29607—28 feb 2026

A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access

35RIESGO

GitHub PoC

bcarrulo/Lab-CVE-2022-30190

CVE-2022-30190HIGHbajo ataqueransomware28 feb 2026

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

100RIESGO

GitHub PoC

GarethMSheldon/CVE-2025-60787-Detection-motionEye-RCE-via-Config-Injection

CVE-2025-60787HIGH28 feb 2026

MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name

61RIESGO

GitHub PoC★ 2

Async RCE scanner for CVE-2025-55182 / CVE-2025-66478 — prototype-pollution → code execution via React Server Actions.

CVE-2025-55182CRITICALbajo ataqueransomware28 feb 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

Metasploit600

openDCIM install.php SQL Injection to RCE

CVE-2026-28516CRITICAL28 feb 2026

openDCIM <= 23.04 SQL Injection in Config::UpdateParameter

43RIESGO

Metasploit600

openDCIM install.php SQL Injection to RCE

CVE-2026-28515CRITICAL28 feb 2026

openDCIM <= 23.04 Missing Authorization in install.php

63RIESGO

Metasploit600

openDCIM install.php SQL Injection to RCE

CVE-2026-28517CRITICAL28 feb 2026

openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter

63RIESGO

GitHub PoC

CVE-2017-9805 S2-052 PoC

CVE-2017-9805HIGHbajo ataque28 feb 2026

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with a

100RIESGO

GitHub PoC

Public advisory and technical analysis for CVE-2026-36590, a NanoMQ v0.24.9 denial-of-service vulnerability.

CVE-2026-36590HIGH28 feb 2026

An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in

41RIESGO

VulnCheck XDB

remote-with-credentials

CVE-2017-9805HIGHbajo ataque28 feb 2026

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with a

100RIESGO

GitHub PoC

Metasploit exploit for the CVE-2025-50286.

CVE-2025-50286HIGH28 feb 2026

A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plug

56RIESGO

VulnCheck XDB

client-side

CVE-2022-30190HIGHbajo ataqueransomware28 feb 2026

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

100RIESGO

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALbajo ataqueransomware28 feb 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC

updated script

CVE-2019-9053—28 feb 2026

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RIESGO

VulnCheck XDB

initial-access

CVE-2026-21902CRITICAL28 feb 2026

Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root

53RIESGO

VulnCheck XDB

local

CVE-2024-21626HIGH28 feb 2026

runc container breakout through process.cwd trickery and leaked fds

61RIESGO

VulnCheck XDB

info-leak

CVE-2026-1581HIGH27 feb 2026

wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection

56RIESGO

VulnCheck XDB

local

CVE-2024-35250HIGHbajo ataque27 feb 2026

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

91RIESGO

GitHub PoC★ 7

CVE-2024-35250 demonstrates that HVCI is not a defense against data-only kernel exploits. As long as a driver bug provides an arbitrary R/W primitive, token swap remains a universal SYSTEM elevation technique — no code execution required.

CVE-2024-35250HIGHbajo ataque27 feb 2026

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

91RIESGO

VulnCheck XDB

initial-access

CVE-2022-42475CRITICALbajo ataqueransomware27 feb 2026

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0

100RIESGO

VulnCheck XDB

initial-access

CVE-2022-21445CRITICALbajo ataque27 feb 2026

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF

90RIESGO

GitHub PoC★ 5

Exploit for CVE-2022-21445 of Oracle Weblogic 12.2.1.X

CVE-2022-21445CRITICALbajo ataque27 feb 2026

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF

90RIESGO

GitHub PoC

ArthurHendrich/CVE-2022-42475-POC

CVE-2022-42475CRITICALbajo ataqueransomware27 feb 2026

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0

100RIESGO

GitHub PoC★ 2

CVE-2025-32433 PoC – SSH Protocol Python-based PoC for controlled lab testing of SSH message handling, channel operations, and pre-auth interactions. Designed for safe security research and analysis.

CVE-2025-32433CRITICALbajo ataque26 feb 2026

Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

100RIESGO

GitHub PoC★ 2

Python implementation of CVE-2023-43208 Mirth Connect RCE (Unauth XStream)

CVE-2023-43208CRITICALbajo ataqueransomware26 feb 2026

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that

100RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.