Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

75.432exploits catalogados

34.424CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.443Referência 21.493GitHub PoC 13.618VulnCheck XDB 8198Nuclei 4217Metasploit 3463✓ solo verificadosrecientes populares riesgo

13.618 exploits

GitHub PoC★ 4

# CVE-2025-0282: Remote Code Execution Vulnerability in [StorkS]

CVE-2025-0282CRITICALbajo ataqueransomware12 ene 2025

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7

100RIESGO

abrir ↗

GitHub PoC★ 53

CVE-2025-0282 is a critical vulnerability found in Ivanti Connect Secure, allowing Remote Command Execution (RCE) through a buffer overflow exploit.

CVE-2025-0282CRITICALbajo ataqueransomware11 ene 2025

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7

100RIESGO

abrir ↗

GitHub PoC

Exploit implementation for CVE-2021-21551

CVE-2021-21551HIGHbajo ataque11 ene 2025

Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile

98RIESGO

abrir ↗

GitHub PoC

poc-cve-2023-3824

CVE-2023-3824CRITICAL11 ene 2025

Buffer overflow and overread in phar_dir_read()

48RIESGO

abrir ↗

GitHub PoC

A Python script to detect CVE-2024-41713, a directory traversal vulnerability in Apache HTTP Server, enabling unauthorized access to restricted resources. This tool is for educational purposes and authorized testing only. Unauthorized usage is unethical and illegal.

CVE-2024-41713CRITICALbajo ataqueransomware11 ene 2025

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could

100RIESGO

abrir ↗

GitHub PoC★ 1

Bludit 3.9.2 - Auth Bruteforce Bypass CVE:2019-17240 Refurbish In bash

CVE-2019-17240LOW11 ene 2025

bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many

40RIESGO

abrir ↗

GitHub PoC

Nxploited/CVE-2024-9932-POC

CVE-2024-9932CRITICAL11 ene 2025

Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

60RIESGO

abrir ↗

GitHub PoC★ 1

GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection

CVE-2024-12877CRITICAL11 ene 2025

GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection

48RIESGO

abrir ↗

GitHub PoC

Nxploited/CVE-2024-49328-exploit

CVE-2024-49328CRITICAL11 ene 2025

WordPress WP REST API FNS Plugin plugin <= 1.0.0 - Account Takeover vulnerability

48RIESGO

abrir ↗

GitHub PoC★ 2

Exploit For: CVE-2024-36840: SQL Injection Vulnerability in Boelter Blue System Management (Version 1.3)

CVE-2024-36840CRITICAL10 ene 2025

SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code a

48RIESGO

abrir ↗

GitHub PoC★ 3

Vulnerable Environment and Exploit for CVE-2024-53677

CVE-2024-53677CRITICAL10 ene 2025

Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

70RIESGO

abrir ↗

GitHub PoC

XSS Test Swagger 3.14.1 to 3.37.0

CVE-2025-8191MEDIUM10 ene 2025

macrozheng mall Swagger UI index.html cross site scripting

33RIESGO

abrir ↗

GitHub PoC★ 5

Fuel CMS 1.4.1 - Remote Code Execution

CVE-2018-16763—08 ene 2025

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca

60RIESGO

abrir ↗

GitHub PoC

The **Dirty Pipe exploit (CVE-2022-0847)** is a Linux kernel vulnerability (v5.8+) allowing unprivileged attackers to overwrite arbitrary files via a flaw in the pipe mechanism. This leads to privilege escalation, granting root access. Similar to Dirty Cow but easier to exploit. Fix: Update to a patched kernel version.

CVE-2022-0847HIGHbajo ataque08 ene 2025

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RIESGO

abrir ↗

GitHub PoC★ 12

CVE-2024-49112 LDAP RCE PoC and Metasploit Module

CVE-2024-49112CRITICAL08 ene 2025

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

70RIESGO

abrir ↗

GitHub PoC★ 1

punitdarji/Apache-struts-cve-2024-53677

CVE-2024-53677CRITICAL08 ene 2025

Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

70RIESGO

abrir ↗

GitHub PoC

Taldrid1/cve-2021-41773

CVE-2021-41773HIGHbajo ataqueransomware07 ene 2025

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

GitHub PoC

JustinYe377/CTF-CVE-2022-0847

CVE-2022-0847HIGHbajo ataque07 ene 2025

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RIESGO

abrir ↗

GitHub PoC★ 121

GeoServer（CVE-2024-36401/CVE-2024-36404）漏洞利用工具

CVE-2024-36401CRITICALbajo ataque07 ene 2025

Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

100RIESGO

abrir ↗

GitHub PoC★ 3

An rewritten POC on the CVE-2014-3704

CVE-2014-3704—06 ene 2025

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct

60RIESGO

abrir ↗

GitHub PoC★ 6

CRUNZEX/CVE-2025-22968

CVE-2025-22968CRITICAL05 ene 2025

An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account witho

48RIESGO

abrir ↗

GitHub PoC

Powershell Script to build token for CVE-2019-1619

CVE-2019-1619CRITICAL04 ene 2025

Cisco Data Center Network Manager Authentication Bypass Vulnerability

85RIESGO

abrir ↗

GitHub PoC

Cacti v1.2.22: Unauthenticated Command Injection Vulnerability (CVE-2022-46169)

CVE-2022-46169CRITICALbajo ataque04 ene 2025

Unauthenticated Command Injection

100RIESGO

abrir ↗

GitHub PoC

oalieno/CVE-2022-41924

CVE-2022-41924CRITICAL04 ene 2025

Tailscale Windows daemon is vulnerable to RCE via CSRF

48RIESGO

abrir ↗

GitHub PoC

Nxploited/CVE-2023-51409

CVE-2023-51409CRITICAL03 ene 2025

WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability

75RIESGO

abrir ↗

GitHub PoC

MASS CVE-2021-41773

CVE-2021-41773HIGHbajo ataqueransomware03 ene 2025

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

GitHub PoC

Exploiting CVE-2023-2825 on a VM

CVE-2023-2825CRITICAL02 ene 2025

An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a

85RIESGO

abrir ↗

GitHub PoC★ 5

Cleo 远程代码执行漏洞批量检测脚本（CVE-2024-50623）

CVE-2024-50623CRITICALbajo ataqueransomware31 dic 2024

In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file up

100RIESGO

abrir ↗

GitHub PoC

luongchivi/Preproduce-CVE-2021-41773

CVE-2021-41773HIGHbajo ataqueransomware30 dic 2024

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

GitHub PoC★ 4

AutoBlue - Automated EternalBlue (CVE-2017-0144 / MS17-010) exploitation tool leveraging Nmap and Metasploit for ethical hacking, penetration testing, and CTF challenges. Strictly for authorized and educational use only!

CVE-2017-0144HIGHbajo ataqueransomware30 dic 2024

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.