Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.682exploits catalogados

39.953CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 25.887Exploit-DB 24.488GitHub PoC 17.378VulnCheck XDB 9888Nuclei 4513Metasploit 3528✓ solo verificadosrecientes populares riesgo

17.378 exploits

GitHub PoC★ 2

AstrBot老版本RCE

CVE-2025-55449HIGH11 nov 2025

AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key us

41RIESGO

abrir ↗

GitHub PoC

harekrishnarai/CVE-2024-23897-test-windows

CVE-2024-23897CRITICALbajo ataqueransomware11 nov 2025

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2025-41244 is a critical local privilege escalation vulnerability in VMware Aria Operations and VMware Tools

CVE-2025-41244HIGHbajo ataque11 nov 2025

VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)

71RIESGO

abrir ↗

GitHub PoC★ 1

check if vulnerable python-django version to CVE-2025-64459 bug

CVE-2025-64459CRITICAL10 nov 2025

Potential SQL injection via _connector keyword argument in QuerySet and Q objects

53RIESGO

abrir ↗

GitHub PoC

Exploit and test stand for CVE-2025-2945

CVE-2025-2945CRITICAL10 nov 2025

pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment

75RIESGO

abrir ↗

GitHub PoC★ 1

WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload

CVE-2025-6440CRITICAL10 nov 2025

WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload

60RIESGO

abrir ↗

GitHub PoC

Ghstxz/CVE-2025-32463

CVE-2025-32463CRITICALbajo ataque10 nov 2025

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RIESGO

abrir ↗

GitHub PoC★ 12

CVE-2025-6554

CVE-2025-6554HIGHbajo ataque09 nov 2025

Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write v

76RIESGO

abrir ↗

GitHub PoC

n0m-d/CVE-2021-40438-POC

CVE-2021-40438CRITICALbajo ataqueransomware09 nov 2025

mod_proxy SSRF

100RIESGO

abrir ↗

GitHub PoC

A proof of concept for CVE-2025-24054/CVE-2025-24071

CVE-2025-24054MEDIUMbajo ataque09 nov 2025

NTLM Hash Disclosure Spoofing Vulnerability

75RIESGO

abrir ↗

GitHub PoC★ 9

AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation

CVE-2025-11749CRITICAL08 nov 2025

AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation

85RIESGO

abrir ↗

GitHub PoC

letsr00t/-CVE-2019-18634-sudo-pwfeedback

CVE-2019-18634—08 nov 2025

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the

28RIESGO

abrir ↗

GitHub PoC

l1nuxkid/CVE-2025-32433-exploit

CVE-2025-32433CRITICALbajo ataque08 nov 2025

Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

100RIESGO

abrir ↗

GitHub PoC★ 1

Emergency Chrome update information and tools for CVE-2023-7024 and other critical vulnerabilities

CVE-2023-7024HIGHbajo ataque07 nov 2025

Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit

71RIESGO

abrir ↗

GitHub PoC★ 10

Firefox/Tor Browser 0day exploit analysis (CVE-2024-9680) A UAF in animation timelines leading to RCE. Patched.

CVE-2024-9680CRITICALbajo ataqueransomware07 nov 2025

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timeli

83RIESGO

abrir ↗

GitHub PoC★ 1

Emergency Chrome update information and tools for CVE-2023-7024 and other critical vulnerabilities

CVE-2023-7024HIGHbajo ataque07 nov 2025

Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit

71RIESGO

abrir ↗

GitHub PoC

Tomcat - PUT Method

CVE-2017-12615HIGHbajo ataqueransomware07 nov 2025

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisati

100RIESGO

abrir ↗

GitHub PoC★ 5

demo CVE-2019-2215 (Bad Binder) for Android Q

CVE-2019-2215HIGHbajo ataque06 nov 2025

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

100RIESGO

abrir ↗

GitHub PoC★ 2

This repository contains research notes and a high-level proof-of-concept (PoC) for CVE-2024-21413, a vulnerability observed in certain mail clients when handling SMB/moniker-style links embedded in messages. The PoC and experiments documented here were performed in a controlled lab environment on systems.

CVE-2024-21413CRITICALbajo ataque06 nov 2025

Microsoft Outlook Remote Code Execution Vulnerability

100RIESGO

abrir ↗

GitHub PoC

CVE-2025-54782

CVE-2025-54782CRITICAL06 nov 2025

@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers

75RIESGO

abrir ↗

GitHub PoC

rockmelodies/django_sqli_target_CVE-2025-64459

CVE-2025-64459CRITICAL06 nov 2025

Potential SQL injection via _connector keyword argument in QuerySet and Q objects

53RIESGO

abrir ↗

GitHub PoC

A Dockerized setup for running a vulnerable CrushFTP 10 server instance (CVE-2024-4040).

CVE-2024-4040CRITICALbajo ataque05 nov 2025

Unauthenticated arbitrary file read and remote code execution in CrushFTP

100RIESGO

abrir ↗

GitHub PoC★ 8

CVE-2025-53690 POC

CVE-2025-53690CRITICALbajo ataque05 nov 2025

Sitecore Products ViewState Deserialization Vulnerability

90RIESGO

abrir ↗

GitHub PoC

Billing CTF Machine_CVE-2023-30258_Remote Code Execution

CVE-2023-30258CRITICAL05 nov 2025

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary com

85RIESGO

abrir ↗

GitHub PoC★ 1

RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT

CVE-2025-9209CRITICAL05 nov 2025

RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT

63RIESGO

abrir ↗

GitHub PoC★ 8

A vulnerability in fiberhome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSID

CVE-2025-63353CRITICAL04 nov 2025

A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-s

48RIESGO

abrir ↗

GitHub PoC★ 10

Breaking down CVE-2025-54253 — an Adobe AEM-Forms exploit path from XXE to full remote code execution and its real-world impact.

CVE-2025-54253CRITICALbajo ataque04 nov 2025

Adobe Experience Manager | Incorrect Authorization (CWE-863)

100RIESGO

abrir ↗

GitHub PoC★ 4

CVE-2025-11953 demonstration: Critical RCE vulnerability in React Native CLI (CVSS 9.8). Educational security research with proof-of-concept exploits and mitigation strategies.

CVE-2025-11953CRITICALbajo ataque04 nov 2025

Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

100RIESGO

abrir ↗

GitHub PoC

PoC for CVE-2024-5932.

CVE-2024-5932CRITICAL04 nov 2025

GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution

85RIESGO

abrir ↗

GitHub PoC★ 1

exploit

CVE-2025-32463CRITICALbajo ataque03 nov 2025

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.