Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

72.018exploits catalogados
32.219CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 20.023GitHub PoC 13.334VulnCheck XDB 8195Nuclei 4217Metasploit 3463✓ solo verificadosrecientespopularesriesgo
72.018 exploits
VulnCheck XDB
local
CVE-2019-10149CRITICALbajo ataque03 dic 2025
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message(
100RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2025-24893CRITICALbajo ataque03 dic 2025
Remote code execution as guest via SolrSearchMacros request in xwiki
100RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2023-26469—03 dic 2025
In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.
60RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2023-46747CRITICALbajo ataqueransomware03 dic 2025
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
100RIESGO
abrir ↗
GitHub PoC
0xDTC/XWiki-Platform-RCE-CVE-2025-24893
CVE-2025-24893CRITICALbajo ataque03 dic 2025
Remote code execution as guest via SolrSearchMacros request in xwiki
100RIESGO
abrir ↗
Exploit-DB
MobileDetect 2.8.31 - Cross-Site Scripting (XSS)
CVE-2018-25080LOW03 dic 2025
MobileDetect Example session_example.php initLayoutType cross site scripting
28RIESGO
abrir ↗
Exploit-DB
RosarioSIS 6.7.2 - Cross Site Scripting (XSS)
CVE-2020-15716—03 dic 2025
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php scrip
23RIESGO
abrir ↗
Exploit-DB
MaNGOSWebV4 4.0.6 - Reflected XSS
CVE-2017-6478—03 dic 2025
paintballrefjosh/MaNGOSWebV4 before 4.0.8 is vulnerable to a reflected XSS in install/index.php (step parameter).
38RIESGO
abrir ↗
Exploit-DB
openSIS Community Edition 8.0 - SQL Injection
CVE-2021-40617—03 dic 2025
An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotPassUserName.php.
23RIESGO
abrir ↗
Exploit-DB
RosarioSIS 6.7.2 - Cross-Site Scripting (XSS)
CVE-2020-15718—03 dic 2025
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php sc
38RIESGO
abrir ↗
Exploit-DB
PluckCMS 4.7.10 - Unrestricted File Upload
CVE-2020-20969HIGH03 dic 2025
File Upload vulnerability in PluckCMS v.4.7.10 allows a remote attacker to execute arbitrary code via the trashcan_resto
41RIESGO
abrir ↗
Exploit-DB
phpIPAM 1.4 - SQL-Injection
CVE-2019-16693—03 dic 2025
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/order.php table parameter when action=add is used.
23RIESGO
abrir ↗
Exploit-DB
phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting (XSS)
CVE-2022-3766HIGH02 dic 2025
Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
56RIESGO
abrir ↗
Metasploit600
WordPress ACF Extended Unauthenticated RCE via prepare_form()
CVE-2025-13486CRITICAL02 dic 2025
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
85RIESGO
abrir ↗
GitHub PoC
sudlit/CVE-2017-7494
CVE-2017-7494CRITICALbajo ataqueransomware02 dic 2025
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
100RIESGO
abrir ↗
Exploit-DB
Piwigo 13.6.0 - SQL Injection
CVE-2023-33362CRITICAL02 dic 2025
Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.
48RIESGO
abrir ↗
GitHub PoC★ 1
PoC for testing CVE-2025-29927 for Next.js versions 11.x, 12.x <= 12.3.5, 13.x <= 13.5.9, 14.x <=14.2.25, 15.x <= 15.2.3
CVE-2025-29927CRITICAL02 dic 2025
Authorization Bypass in Next.js Middleware
85RIESGO
abrir ↗
Exploit-DB
phpIPAM 1.6 - Reflected Cross-Site Scripting (XSS)
CVE-2024-41358MEDIUM02 dic 2025
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php.
33RIESGO
abrir ↗
VulnCheck XDB
local
CVE-2021-21551HIGHbajo ataque02 dic 2025
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
98RIESGO
abrir ↗
Exploit-DB
YOURLS 1.8.2 - Cross-Site Request Forgery (CSRF)
CVE-2022-0088LOW02 dic 2025
Cross-Site Request Forgery (CSRF) in yourls/yourls
28RIESGO
abrir ↗
Exploit-DB
phpIPAM 1.6 - Reflected-Cross-Site Scripting (XSS)
CVE-2024-41357HIGH02 dic 2025
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php.
41RIESGO
abrir ↗
VulnCheck XDB
infoleak
CVE-2025-29927CRITICAL02 dic 2025
Authorization Bypass in Next.js Middleware
85RIESGO
abrir ↗
VulnCheck XDB
client-side
CVE-2025-43300CRITICALbajo ataque02 dic 2025
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 1
83RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2017-7494CRITICALbajo ataqueransomware02 dic 2025
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
100RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2019-0232—02 dic 2025
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0
60RIESGO
abrir ↗
Exploit-DB
phpIPAM 1.5.1 - SQL Injection
CVE-2023-1211HIGH02 dic 2025
SQL Injection in phpipam/phpipam
41RIESGO
abrir ↗
GitHub PoC
boro03/CVE-2021-4034
CVE-2021-4034HIGHbajo ataque02 dic 2025
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RIESGO
abrir ↗
GitHub PoC★ 1
Jorge2Rubio/CVE-2019-0232
CVE-2019-0232—02 dic 2025
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0
60RIESGO
abrir ↗
GitHub PoC
towaos/towaos-lab-cve-2020-11023
CVE-2020-11023MEDIUMbajo ataque02 dic 2025
Potential XSS vulnerability in jQuery
85RIESGO
abrir ↗
GitHub PoC
This repo contain a PoC I have done when blind analysis the dbutil_2_3.sys driver for vulnerability. This was created by personal analysis without looking at writeups or even know which CVE exist in this driver. All the knowledge I have is that this driver is vulnerable in some way.
CVE-2021-21551HIGHbajo ataque02 dic 2025
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
98RIESGO
abrir ↗
← anteriorpágina 168 / 2401siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.