Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.880exploits catalogados

40.036CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 25.956Exploit-DB 24.488GitHub PoC 17.450VulnCheck XDB 9931Nuclei 4527Metasploit 3528✓ solo verificadosrecientes populares riesgo

17.450 exploits

GitHub PoC★ 2

A combined POC for CVE-2021-31955, CVE-2015-4077, and CVE-2015-5736

CVE-2021-31955MEDIUMbajo ataque29 oct 2025

Windows Kernel Information Disclosure Vulnerability

85RIESGO

abrir ↗

GitHub PoC★ 2

A combined POC for CVE-2021-31955, CVE-2015-4077, and CVE-2015-5736

CVE-2015-4077—29 oct 2025

The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient b

23RIESGO

abrir ↗

GitHub PoC

TranDongA3/Simulation_CVE-2024-46256

CVE-2024-46256CRITICAL29 oct 2025

A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add

48RIESGO

abrir ↗

GitHub PoC

Zohaibkhan1472/cve-2023-6019

CVE-2023-6019CRITICAL28 oct 2025

Ray Command Injection in cpu_profile Parameter

85RIESGO

abrir ↗

GitHub PoC

Demo of CVE-2021-44228 Log4Shell.

CVE-2021-44228CRITICALbajo ataqueransomware28 oct 2025

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC★ 96

POC of CVE-2018-9995 written in Rust.

CVE-2018-9995—28 oct 2025

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR L

60RIESGO

abrir ↗

GitHub PoC

ict519 assignment

CVE-2023-38831HIGHbajo ataqueransomware28 oct 2025

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a

100RIESGO

abrir ↗

GitHub PoC★ 1

Exploit for Remote Code Execution in ColdFusion 2021 (CVE-2023-26360)

CVE-2023-26360HIGHbajo ataque28 oct 2025

Adobe ColdFusion Improper Access Control Arbitrary code execution

100RIESGO

abrir ↗

GitHub PoC★ 1

A Metasploit module for CVE-2024-35374

CVE-2024-35374CRITICAL28 oct 2025

Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing

48RIESGO

abrir ↗

GitHub PoC

A powerful and reliable exploit tool for Apache HTTP Server vulnerabilities CVE-2021-41773 and CVE-2021-42013. This tool provides remote code execution capabilities on vulnerable Apache 2.4.49 and 2.4.50 servers.

CVE-2021-42013CRITICALbajo ataqueransomware28 oct 2025

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RIESGO

abrir ↗

GitHub PoC

CVE-2021-22204 exiftool rce

CVE-2021-22204MEDIUMbajo ataque27 oct 2025

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec

100RIESGO

abrir ↗

GitHub PoC

Alex-Acero-Security/CVE-2025-20260-POC

CVE-2025-20260CRITICAL27 oct 2025

ClamAV PDF Scanning Buffer Overflow Vulnerability

48RIESGO

abrir ↗

GitHub PoC

CaelumIsMe/CVE-2020-29607-POC

CVE-2020-29607—27 oct 2025

A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access

35RIESGO

abrir ↗

GitHub PoC

lucaschanzx/CVE-2025-29927-PoC

CVE-2025-29927CRITICAL27 oct 2025

Authorization Bypass in Next.js Middleware

85RIESGO

abrir ↗

GitHub PoC

CVE-2025-26263 - GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less, is vulnerable to credentials disclosure due to improper memory handling in the ASManagerService.exe process.

CVE-2025-26263MEDIUM26 oct 2025

GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to cred

33RIESGO

abrir ↗

GitHub PoC

Exploit Code for CVE-2018-15473

CVE-2018-15473MEDIUM26 oct 2025

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati

70RIESGO

abrir ↗

GitHub PoC★ 7

mcp-remote exposed to OS command injection

CVE-2025-6514CRITICAL26 oct 2025

OS command injection in mcp-remote when connecting to untrusted MCP servers

70RIESGO

abrir ↗

GitHub PoC

aadi0258/Exploit-CVE-2024-23897

CVE-2024-23897CRITICALbajo ataqueransomware26 oct 2025

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RIESGO

abrir ↗

GitHub PoC

rvzsec/CVE-2025-24893

CVE-2025-24893CRITICALbajo ataque25 oct 2025

Remote code execution as guest via SolrSearchMacros request in xwiki

100RIESGO

abrir ↗

GitHub PoC

kso4more/CVE-2025-0108

CVE-2025-0108HIGHbajo ataque25 oct 2025

PAN-OS: Authentication Bypass in the Management Web Interface

100RIESGO

abrir ↗

GitHub PoC★ 3

Exploit for CVE-2019-11043

CVE-2019-11043HIGHbajo ataqueransomware24 oct 2025

Underflow in PHP-FPM can lead to RCE

100RIESGO

abrir ↗

GitHub PoC★ 1

Sudo chroot privileged escalation PoC

CVE-2025-32463CRITICALbajo ataque24 oct 2025

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RIESGO

abrir ↗

GitHub PoC★ 1

Langflow 在对用户提交的“验证代码”做 AST 解析和编译时，在未做鉴权与沙箱限制的情况下调用了 Python 的 compile()/exec()（以及在编译阶段会评估函数默认参数与装饰器），攻击者可把恶意载荷放在参数默认值或装饰器里，借此在服务器上下文中执行任意语句（反弹 shell、下载器、横向移动等）

CVE-2025-3248CRITICALbajo ataqueransomware24 oct 2025

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

100RIESGO

abrir ↗

GitHub PoC★ 1

I was presented with a high-severity alert indicating a potential exploit attempt of CVE-2023-22515, a zero-day vulnerability in Atlassian Confluence. The alert showed a suspicious GET request from an external IP targeting the Confluence server, suggesting an attempt to gain unauthorised admin access.

CVE-2023-22515CRITICALbajo ataqueransomware24 oct 2025

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited

100RIESGO

abrir ↗

GitHub PoC

ChCh0i/cve-2025-1550

CVE-2025-1550HIGH24 oct 2025

Arbitrary Code Execution via Crafted Keras Config for Model Loading

41RIESGO

abrir ↗

GitHub PoC★ 2

Quick and Simple Scripts to Scan for Vulnerable Servers and Packet Level Monitors

CVE-2025-55315CRITICAL24 oct 2025

ASP.NET Security Feature Bypass Vulnerability

60RIESGO

abrir ↗

GitHub PoC★ 1

Exploit for CVE-2019-18935

CVE-2019-18935CRITICALbajo ataqueransomware23 oct 2025

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUp

100RIESGO

abrir ↗

GitHub PoC

srakkk/cve-2024-32002-demo

CVE-2024-32002CRITICAL23 oct 2025

Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

53RIESGO

abrir ↗

GitHub PoC

srakkk/cve-2024-32002-hook

CVE-2024-32002CRITICAL23 oct 2025

Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

53RIESGO

abrir ↗

GitHub PoC

Writeup for Tenda AC15 router firmware rehosting and remote command execution (CVE-2020-10987) exploit replication.

CVE-2020-10987CRITICALbajo ataque23 oct 2025

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary s

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.