Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.957exploits catalogados
32.195CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8182Nuclei 4217Metasploit 3462✓ solo verificadosrecientespopularesriesgo
13.303 exploits
GitHub PoC
Armand2002/Exploit-CVE-2025-1974-Lab
CVE-2025-1974CRITICAL14 jul 2025
ingress-nginx admission controller RCE escalation
85RIESGO
abrir ↗
GitHub PoC★ 2
🚀 Exploit for Moodle 4.4.0 Authenticated RCE (CVE-2024-43425) — run commands remotely ⚡
CVE-2024-43425HIGH13 jul 2025
Moodle: remote code execution via calculated question types
78RIESGO
abrir ↗
GitHub PoC
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
CVE-2025-31125MEDIUMbajo ataque13 jul 2025
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
90RIESGO
abrir ↗
GitHub PoC
CVE-2025-32023
CVE-2025-32023HIGH13 jul 2025
Redis allows out of bounds writes in hyperloglog commands leading to RCE
41RIESGO
abrir ↗
GitHub PoC★ 14
A detailed walkthrough of TryHackMe's Billing room exploiting CVE-2023-30258 and escalating via fail2ban misconfig
CVE-2023-30258CRITICAL13 jul 2025
Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary com
85RIESGO
abrir ↗
GitHub PoC
JayVillain/Scan-CVE-2025-6058
CVE-2025-6058CRITICAL13 jul 2025
WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
63RIESGO
abrir ↗
GitHub PoC
This is a security assessment report regarding the EthernalBlue vulnerability (CVE-2017-0143).
CVE-2017-0143HIGHbajo ataqueransomware13 jul 2025
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RIESGO
abrir ↗
GitHub PoC★ 8
Wazuh 8.4 CVE-2025-24016
CVE-2025-24016CRITICALbajo ataque13 jul 2025
Remote code execution in Wazuh server
100RIESGO
abrir ↗
GitHub PoC
CVE-2020-35848 impacts Cockpit-CMS v1.7 due to unsafe handling of user inputs in authentication mechanisms, leading to remote code execution. This lab is built for CTF players and bug bounty learners to simulate real-world exploitation workflows including token extraction, password reset, and flag capture.
CVE-2020-35848—13 jul 2025
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.
60RIESGO
abrir ↗
GitHub PoC
pkblanks/Remediating-CVE-2013-3900-EnableCertPaddingCheck-
CVE-2013-3900MEDIUMbajo ataque12 jul 2025
WinVerifyTrust Signature Validation Vulnerability
75RIESGO
abrir ↗
GitHub PoC
r0otk3r/CVE-2022-1388
CVE-2022-1388CRITICALbajo ataqueransomware12 jul 2025
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RIESGO
abrir ↗
GitHub PoC
Tool for detecting and exploiting CVE-2025-25257 in Fortinet FortiWeb.
CVE-2025-25257CRITICALbajo ataque12 jul 2025
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RIESGO
abrir ↗
GitHub PoC
Proof of Concept for CVE-2025-24813, a Remote Code Execution vulnerability in Apache Tomcat. This PoC exploits unsafe deserialization via crafted session files uploaded through HTTP PUT requests, allowing attackers to execute arbitrary code remotely on vulnerable Tomcat servers.
CVE-2025-24813CRITICALbajo ataque12 jul 2025
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RIESGO
abrir ↗
GitHub PoC★ 1
Exploiting the CVE-2025-25257 vulnerability in FortiWeb. This repository demonstrates secure pre-authenticated SQL injection.
CVE-2025-25257CRITICALbajo ataque12 jul 2025
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RIESGO
abrir ↗
GitHub PoC★ 1
imbas007/CVE-2025-25257
CVE-2025-25257CRITICALbajo ataque12 jul 2025
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RIESGO
abrir ↗
GitHub PoC★ 1
Python exploit for vsftpd 2.3.4 - Backdoor Command Execution
CVE-2011-2523—12 jul 2025
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RIESGO
abrir ↗
GitHub PoC
r0otk3r/CVE-2024-1212
CVE-2024-1212CRITICALbajo ataque12 jul 2025
LoadMaster Pre-Authenticated OS Command Injection
100RIESGO
abrir ↗
GitHub PoC
WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
CVE-2025-6058CRITICAL12 jul 2025
WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
63RIESGO
abrir ↗
GitHub PoC
MacUchegit/Detecting-and-Analyzing-CVE-2024-24919-Exploitation
CVE-2024-24919HIGHbajo ataqueransomware12 jul 2025
Information disclosure
100RIESGO
abrir ↗
GitHub PoC
Metasploit module for MailEnable CVE-2022-36934 authentication bypass RCE
CVE-2022-36934CRITICAL11 jul 2025
An integer overflow in WhatsApp could result in remote code execution in an established video call.
48RIESGO
abrir ↗
GitHub PoC
cuijiung/log4j-CVE-2021-44228
CVE-2021-44228CRITICALbajo ataqueransomware11 jul 2025
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗
GitHub PoC★ 6
CVE-2025-24201 WebKit Vulnerability Detector (PoC)
CVE-2025-24201CRITICALbajo ataque11 jul 2025
An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in
78RIESGO
abrir ↗
GitHub PoC
Delivering PHP RCE (CVE-2024-4577) to the Local Network Servers
CVE-2024-4577CRITICALbajo ataqueransomware11 jul 2025
Argument Injection in PHP-CGI
100RIESGO
abrir ↗
GitHub PoC
hackmelocal/CVE-2025-49113-Simulation
CVE-2025-49113CRITICALbajo ataque11 jul 2025
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the
100RIESGO
abrir ↗
GitHub PoC
Rust PoC for CVE-2025-32463 (sudo chroot "chwoot" Local PrivEsc)
CVE-2025-32463CRITICALbajo ataque11 jul 2025
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RIESGO
abrir ↗
GitHub PoC
This repository contains Detailed explanation and working poc for Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution.
CVE-2014-6287CRITICALbajo ataque11 jul 2025
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RIESGO
abrir ↗
GitHub PoC
just remeber how small mistake in santisize username could give yoy root access to the full machine
CVE-2007-2447—11 jul 2025
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands
50RIESGO
abrir ↗
GitHub PoC
Critical Sudo Vulnerabilities Let Local Users Gain Root Access on Linux, Impacting Major Distros
CVE-2025-32462LOW11 jul 2025
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allo
28RIESGO
abrir ↗
GitHub PoC
r0otk3r/CVE-2024-10915
CVE-2024-10915CRITICAL11 jul 2025
D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
85RIESGO
abrir ↗
GitHub PoC
Documentation for CVE-2025-6514. MCP-Remote RCE.
CVE-2025-6514CRITICAL11 jul 2025
OS command injection in mcp-remote when connecting to untrusted MCP servers
70RIESGO
abrir ↗
← anteriorpágina 135 / 444siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.