Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

75.432exploits catalogados

34.424CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.443Referência 21.493GitHub PoC 13.618VulnCheck XDB 8198Nuclei 4217Metasploit 3463✓ solo verificadosrecientes populares riesgo

75.432 exploits

GitHub PoC

Practical security research project exploiting CVE-2025-32463 to gain root access on a vulnerable sudo version. Includes write-up, PoC, and mitigation steps.

CVE-2025-32463CRITICALbajo ataque16 nov 2025

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RIESGO

VulnCheck XDB

local

CVE-2025-32463CRITICALbajo ataque16 nov 2025

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RIESGO

VulnCheck XDB

local

CVE-2025-21479HIGHbajo ataque16 nov 2025

Incorrect Authorization in Graphics

71RIESGO

GitHub PoC

D-link AX1500 Vulnerability

CVE-2025-60854CRITICAL16 nov 2025

A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter during

48RIESGO

GitHub PoC

honeyvig/CVE-2022-0847-DirtyPipe-Exploit

CVE-2022-0847HIGHbajo ataque16 nov 2025

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RIESGO

GitHub PoC

This repository contains my work for a cybersecurity assignment where I exploited the real-world Log4Shell (CVE-2021-44228) vulnerability inside a safe, controlled virtual machine. The project followed a Capture-the-Flag format with multiple exploitation tasks to retrieve hidden flags.

CVE-2021-44228CRITICALbajo ataqueransomware16 nov 2025

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

GitHub PoC★ 13

Unauthenticated RCE PoC in Microsoft Windows Server Update Service (WSUS) - CVE-2025-59287 & CVE-2023-35317

CVE-2025-59287CRITICALbajo ataque16 nov 2025

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

100RIESGO

GitHub PoC

Detection, Exploit and Mitigation for CVE 2023 46604.

CVE-2023-46604CRITICALbajo ataqueransomware15 nov 2025

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

100RIESGO

GitHub PoC★ 1

Twodimensionalitylevelcrossing817/CVE-2025-59287

CVE-2025-59287CRITICALbajo ataque15 nov 2025

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

100RIESGO

GitHub PoC★ 1

CVE-2025-64328 FreePBX Authenticated Command Injection in the framework module.

CVE-2025-64328HIGHbajo ataque15 nov 2025

FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

100RIESGO

GitHub PoC★ 13

soltanali0/CVE-2025-64446-Exploit

CVE-2025-64446CRITICALbajo ataque15 nov 2025

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RIESGO

GitHub PoC★ 2

Python3-converted exploit and research notes for CMS Made Simple (CVE-2019-9053) — Unauthenticated SQL Injection vulnerability. Includes original PoC, improved Python3 version, usage instructions, and lab testing reference.

CVE-2019-9053—15 nov 2025

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RIESGO

VulnCheck XDB

initial-access

CVE-2025-64446CRITICALbajo ataque15 nov 2025

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RIESGO

VulnCheck XDB

remote-with-credentials

CVE-2025-33073HIGHbajo ataque15 nov 2025

Windows SMB Client Elevation of Privilege Vulnerability

93RIESGO

VulnCheck XDB

initial-access

CVE-2025-64446CRITICALbajo ataque15 nov 2025

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RIESGO

VulnCheck XDB

infoleak

CVE-2025-64446CRITICALbajo ataque14 nov 2025

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RIESGO

VulnCheck XDB

initial-access

CVE-2025-11700HIGH14 nov 2025

N-central Multiple XXE Injection Vulnerabilities

68RIESGO

VulnCheck XDB

client-side

CVE-2025-33073HIGHbajo ataque14 nov 2025

Windows SMB Client Elevation of Privilege Vulnerability

93RIESGO

GitHub PoC★ 7

# CVE-2025-64446 PoC - FortiWeb Path Traversal Proof of Concept para la vulnerabilidad de path traversal en Fortinet FortiWeb que permite ejecución remota de comandos. Incluye herramienta de detección para fines educativos. **⚠️ SOLO USO EDUCATIVO - NO PARA EXPLOTACIÓN ⚠️**

CVE-2025-64446CRITICALbajo ataque14 nov 2025

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RIESGO

GitHub PoC★ 13

sxyrxyy/CVE-2025-64446-FortiWeb-CGI-Bypass-PoC

CVE-2025-64446CRITICALbajo ataque14 nov 2025

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RIESGO

VulnCheck XDB

initial-access

CVE-2022-22965CRITICALbajo ataque14 nov 2025

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RIESGO

VulnCheck XDB

initial-access

CVE-2025-9316MEDIUM14 nov 2025

N-central unauthenticated sessionID generation

60RIESGO

VulnCheck XDB

local

CVE-2025-62215HIGHbajo ataque14 nov 2025

Windows Kernel Elevation of Privilege Vulnerability

71RIESGO

VulnCheck XDB

initial-access

CVE-2025-64446CRITICALbajo ataque14 nov 2025

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RIESGO

GitHub PoC★ 32

CVE-2025-62215 is an Elevation of Privilege (EoP) vulnerability in the Windows Kernel, disclosed in November 2025 and confirmed to be actively exploited as a zero-day.

CVE-2025-62215HIGHbajo ataque14 nov 2025

Windows Kernel Elevation of Privilege Vulnerability

71RIESGO

GitHub PoC

CVE-2022-22965 proof of concept for CS4239 report

CVE-2022-22965CRITICALbajo ataque14 nov 2025

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RIESGO

GitHub PoC★ 1

PoC for CVE-2025-64513 — Milvus Proxy Authentication Bypass Vulnerability Batch scanner to verify unauthorized access and gather Milvus version, health, and database info. For security research and defensive validation only.

CVE-2025-64513CRITICAL14 nov 2025

Milvus Proxy has Critical Authentication Bypass Vulnerability

48RIESGO

Metasploit300

Fortinet FortiWeb create new local admin

CVE-2025-64446CRITICALbajo ataque14 nov 2025

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RIESGO

GitHub PoC★ 67

Universal exploitation tool for CVE-2025-33073 targeting Windows Domain Controllers with DNSAdmins privileges and WinRM enabled.

CVE-2025-33073HIGHbajo ataque14 nov 2025

Windows SMB Client Elevation of Privilege Vulnerability

93RIESGO

Metasploit600

Fortinet FortiWeb unauthenticated RCE

CVE-2025-64446CRITICALbajo ataque14 nov 2025

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.