Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

74.469exploits catalogados

34.020CVEs con explotación pública

19.614probados en laboratorio

Todos Exploit-DB 23.949Referência 21.283GitHub PoC 13.359VulnCheck XDB 8198Nuclei 4217Metasploit 3463✓ solo verificadosrecientes populares riesgo

75.017 exploits

GitHub PoC★ 1

Proof‑of‑concept for CVE‑2024‑58258, a SugarCRM (<13.0.4 / <14.0.1) flaw where user input is parsed as LESS in /css/preview, allowing unauthenticated SSRF or local file access.

CVE-2024-58258HIGH21 nov 2025

SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can

46RIESGO

GitHub PoC★ 2

A self-contained testbed for Django CVE-2025-64459. Demonstrates QuerySet.filter() parameter injection via dictionary expansion using Docker.

CVE-2025-64459CRITICAL21 nov 2025

Potential SQL injection via _connector keyword argument in QuerySet and Q objects

53RIESGO

GitHub PoC★ 4

Oracle Identity Manager 远程代码执行漏洞CVE-2025-61757

CVE-2025-61757CRITICALbajo ataque21 nov 2025

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported vers

100RIESGO

GitHub PoC★ 1

Proof‑of‑concept description for CVE‑2025‑47916, a Remote Code Execution vulnerability affecting Invision Community 5.0.0–5.0.6 via unsafe template processing in the "customCss()" method.

CVE-2025-47916CRITICAL21 nov 2025

Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The

85RIESGO

GitHub PoC

Sorumluluk Reddi Kendi sorumluluğunuzda kullanın, size ait olmayan veya tarama izninizin olmadığı altyapılarda gerçekleştireceğiniz yasa dışı faaliyetlerden sorumlu olmayacağım.

CVE-2025-61882CRITICALbajo ataqueransomware21 nov 2025

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integratio

100RIESGO

VulnCheck XDB

initial-access

CVE-2025-59287CRITICALbajo ataque21 nov 2025

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

100RIESGO

VulnCheck XDB

initial-access

CVE-2025-47916CRITICAL21 nov 2025

Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The

85RIESGO

VulnCheck XDB

initial-access

CVE-2025-64446CRITICALbajo ataque21 nov 2025

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RIESGO

GitHub PoC★ 1

Adel-kaka-dz/cve-2025-59287

CVE-2025-59287CRITICALbajo ataque21 nov 2025

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

100RIESGO

GitHub PoC

Hands-on security lab demonstrating CVE-2023-22515 — Atlassian Confluence Authentication Bypass using a simulated vulnerable environment.

CVE-2023-22515CRITICALbajo ataqueransomware21 nov 2025

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited

100RIESGO

GitHub PoC★ 1

Reproducible incident micro-postmortem for on-prem Microsoft SharePoint “ToolShell” (CVE-2025-53770): ATT&CK snapshot, “logs that matter” table, three hunts (KQL/SPL/Sigma), first-4-hours comms, sample data, and figures. Built for fast triage; no org data; SharePoint Online out of scope.

CVE-2025-53770CRITICALbajo ataqueransomware21 nov 2025

Microsoft SharePoint Server Remote Code Execution Vulnerability

100RIESGO

GitHub PoC★ 1

Fully automated Confluence RCE exploit (CVE-2023-22527 + OGNL injection) 100% from scratch • Python • 2025

CVE-2023-22527CRITICALbajo ataqueransomware21 nov 2025

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated atta

100RIESGO

GitHub PoC★ 1

SAP RCE auto-chain (CVE-2024-22127 + DIAG)

CVE-2024-22127CRITICAL21 nov 2025

Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in)

48RIESGO

GitHub PoC

WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover

CVE-2025-13390CRITICAL20 nov 2025

WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover

63RIESGO

GitHub PoC

thepiyushkumarshukla/CVE-2022-24707_AnukoTimeTracker_Version-1.20.0_POC

CVE-2022-24707HIGH20 nov 2025

SQL injection in anuko timetracker

41RIESGO

GitHub PoC

On February 13th, 2024, Microsoft announced a Microsoft Outlook RCE & credential leak vulnerability with the assigned CVE of CVE-2024-21413 (Moniker Link). Haifei Li of Check Point Research is credited with discovering the vulnerability. The vulnerability bypasses Outlook's security mechanisms when handing a specific type of hyperlink .

CVE-2024-21413CRITICALbajo ataque20 nov 2025

Microsoft Outlook Remote Code Execution Vulnerability

100RIESGO

GitHub PoC

anelya0333/Exploiting-CVE-2023-38831

CVE-2023-38831HIGHbajo ataqueransomware20 nov 2025

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a

100RIESGO

VulnCheck XDB

initial-access

CVE-2025-3248CRITICALbajo ataqueransomware20 nov 2025

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

100RIESGO

VulnCheck XDB

client-side

CVE-2024-21413CRITICALbajo ataque20 nov 2025

Microsoft Outlook Remote Code Execution Vulnerability

100RIESGO

VulnCheck XDB

initial-access

CVE-2022-22965CRITICALbajo ataque20 nov 2025

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RIESGO

GitHub PoC

Security research tool for detecting and testing CVE-2025-12735 (expr-eval RCE vulnerability)

CVE-2025-12735CRITICAL20 nov 2025

CVE-2025-12735

48RIESGO

VulnCheck XDB

local

CVE-2025-11001HIGH20 nov 2025

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability

46RIESGO

GitHub PoC★ 1

Fully automated Spring4Shell (CVE-2022-22965) + GitLab RCE framework

CVE-2022-22965CRITICALbajo ataque20 nov 2025

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RIESGO

VulnCheck XDB

initial-access

CVE-2025-13390CRITICAL20 nov 2025

WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover

63RIESGO

GitHub PoC

Kalrav AI Agent <= 2.3.3 - Unauthenticated Arbitrary File Upload via kalrav_upload_file AJAX Action

CVE-2025-13374CRITICAL20 nov 2025

Kalrav AI Agent <= 2.3.3 - Unauthenticated Arbitrary File Upload via kalrav_upload_file AJAX Action

48RIESGO

VulnCheck XDB

remote-with-credentials

CVE-2025-61757CRITICALbajo ataque20 nov 2025

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported vers

100RIESGO

GitHub PoC

lastvocher/7zip-CVE-2025-11001

CVE-2025-11001HIGH20 nov 2025

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability

46RIESGO

GitHub PoC★ 3

A comprehensive Python exploitation framework for testing and demonstrating CVE-2025-3248, a critical unauthenticated remote code execution vulnerability in Langflow versions ≤ 1.3.0.

CVE-2025-3248CRITICALbajo ataqueransomware20 nov 2025

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

100RIESGO

VulnCheck XDB

remote-with-credentials

CVE-2021-1675HIGHbajo ataqueransomware19 nov 2025

Windows Print Spooler Remote Code Execution Vulnerability

100RIESGO

GitHub PoC★ 4

MonstaFTP Unauthenticated File Upload

CVE-2025-34299CRITICAL19 nov 2025

Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload

85RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.