Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.886exploits catalogados

32.153CVEs con explotación pública

1932probados en laboratorio

Todos Exploit-DB 22.786Referência 19.978GitHub PoC 13.282VulnCheck XDB 8176Nuclei 4202Metasploit 3462✓ solo verificadosrecientes populares riesgo

13.282 exploits

GitHub PoC★ 2

This repository contains research notes and a high-level proof-of-concept (PoC) for CVE-2024-21413, a vulnerability observed in certain mail clients when handling SMB/moniker-style links embedded in messages. The PoC and experiments documented here were performed in a controlled lab environment on systems.

CVE-2024-21413CRITICALbajo ataque06 nov 2025

Microsoft Outlook Remote Code Execution Vulnerability

100RIESGO

GitHub PoC

A Dockerized setup for running a vulnerable CrushFTP 10 server instance (CVE-2024-4040).

CVE-2024-4040CRITICALbajo ataque05 nov 2025

Unauthenticated arbitrary file read and remote code execution in CrushFTP

100RIESGO

GitHub PoC

Billing CTF Machine_CVE-2023-30258_Remote Code Execution

CVE-2023-30258CRITICAL05 nov 2025

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary com

85RIESGO

GitHub PoC★ 1

RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT

CVE-2025-9209CRITICAL05 nov 2025

RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT

63RIESGO

GitHub PoC★ 8

CVE-2025-53690 POC

CVE-2025-53690CRITICALbajo ataque05 nov 2025

Sitecore Products ViewState Deserialization Vulnerability

90RIESGO

GitHub PoC

PoC for CVE-2024-5932.

CVE-2024-5932CRITICAL04 nov 2025

GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution

85RIESGO

GitHub PoC★ 4

CVE-2025-11953 demonstration: Critical RCE vulnerability in React Native CLI (CVSS 9.8). Educational security research with proof-of-concept exploits and mitigation strategies.

CVE-2025-11953CRITICALbajo ataque04 nov 2025

Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

90RIESGO

GitHub PoC★ 8

A vulnerability in fiberhome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSID

CVE-2025-63353CRITICAL04 nov 2025

A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-s

48RIESGO

GitHub PoC★ 10

Breaking down CVE-2025-54253 — an Adobe AEM-Forms exploit path from XXE to full remote code execution and its real-world impact.

CVE-2025-54253CRITICALbajo ataque04 nov 2025

Adobe Experience Manager | Incorrect Authorization (CWE-863)

100RIESGO

GitHub PoC★ 1

XWiki Unauthenticated RCE Exploit for Reverse Shell

CVE-2025-24893CRITICALbajo ataque03 nov 2025

Remote code execution as guest via SolrSearchMacros request in xwiki

100RIESGO

GitHub PoC★ 1

This is a customized script to help solve the lab on remote code execution under the CVE-2015-3306 lab.

CVE-2015-3306—02 nov 2025

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and

60RIESGO

GitHub PoC★ 1

Exploit for CVE-2025-2011

CVE-2025-2011HIGH02 nov 2025

Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter

68RIESGO

GitHub PoC★ 1

My view on IngressNightmare vulnerability (CVE-2025-1974)

CVE-2025-1974CRITICAL02 nov 2025

ingress-nginx admission controller RCE escalation

85RIESGO

GitHub PoC★ 1

A Proof of Concept (PoC) exploit for CVE-2015-1328

CVE-2015-1328—01 nov 2025

The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does no

50RIESGO

GitHub PoC

CVE-2024-9047

CVE-2024-9047CRITICAL01 nov 2025

WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php

85RIESGO

GitHub PoC

Exploit for CVE-2021-3560 Polkit Local Privilege Escalation Vulnerability

CVE-2021-3560HIGHbajo ataque01 nov 2025

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile

91RIESGO

GitHub PoC★ 25

Proof-of-concept for CVE-2025-49844

CVE-2025-49844CRITICAL31 oct 2025

Redis Lua Use-After-Free may lead to remote code execution

85RIESGO

GitHub PoC

Mahfujurjust/CVE-2021-41773

CVE-2021-41773HIGHbajo ataqueransomware31 oct 2025

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

GitHub PoC★ 1

adrianmafandy/CVE-2021-41773

CVE-2021-41773HIGHbajo ataqueransomware31 oct 2025

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

GitHub PoC

A XXE payload generator

CVE-2021-29447HIGH31 oct 2025

WordPress Authenticated XXE attack when installation is running PHP 8

63RIESGO

GitHub PoC★ 1

shiro 路径穿越

CVE-2010-3863—31 oct 2025

Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the

35RIESGO

GitHub PoC

Fast, socket-level scanner for detecting CVE-2022-22536 in SAP ICM or Web Dispatcher instances. Performs request smuggling tests with a crafted MPI-desync payload. Supports batch scanning IP:PORT targets via plain text files.

CVE-2022-22536CRITICALbajo ataque31 oct 2025

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and

100RIESGO

GitHub PoC★ 1

WooCommerce Designer Pro 1.9.26 - Arbitrary File Upload

CVE-2025-6440CRITICAL30 oct 2025

WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload

60RIESGO

GitHub PoC★ 2

A combined POC for CVE-2021-31955, CVE-2015-4077, and CVE-2015-5736

CVE-2021-31955MEDIUMbajo ataque29 oct 2025

Windows Kernel Information Disclosure Vulnerability

85RIESGO

GitHub PoC

TranDongA3/Simulation_CVE-2024-46256

CVE-2024-46256CRITICAL29 oct 2025

A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add

48RIESGO

GitHub PoC★ 2

A combined POC for CVE-2021-31955, CVE-2015-4077, and CVE-2015-5736

CVE-2015-4077—29 oct 2025

The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient b

23RIESGO

GitHub PoC★ 1

A Metasploit module for CVE-2024-35374

CVE-2024-35374CRITICAL28 oct 2025

Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing

48RIESGO

GitHub PoC

Zohaibkhan1472/cve-2023-6019

CVE-2023-6019CRITICAL28 oct 2025

Ray Command Injection in cpu_profile Parameter

85RIESGO

GitHub PoC

ict519 assignment

CVE-2023-38831HIGHbajo ataqueransomware28 oct 2025

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a

100RIESGO

GitHub PoC

A powerful and reliable exploit tool for Apache HTTP Server vulnerabilities CVE-2021-41773 and CVE-2021-42013. This tool provides remote code execution capabilities on vulnerable Apache 2.4.49 and 2.4.50 servers.

CVE-2021-42013CRITICALbajo ataqueransomware28 oct 2025

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.