Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.883exploits catalogados

40.037CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 25.956Exploit-DB 24.488GitHub PoC 17.453VulnCheck XDB 9931Nuclei 4527Metasploit 3528✓ solo verificadosrecientes populares riesgo

17.453 exploits

GitHub PoC

CS50 Cybersecurity final project — Palo Alto OAuth token breach (CVE-2024-3400)

CVE-2024-3400CRITICALbajo ataqueransomware01 oct 2025

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

100RIESGO

abrir ↗

GitHub PoC★ 13

watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242

CVE-2025-9242CRITICALbajo ataque01 oct 2025

WatchGuard Firebox iked Out of Bounds Write Vulnerability

100RIESGO

abrir ↗

GitHub PoC★ 1

This is POC for IOS 0click CVE-2025-43300

CVE-2025-43300CRITICALbajo ataque30 sep 2025

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 1

90RIESGO

abrir ↗

GitHub PoC★ 3

ticofookfook/CVE-2025-43300

CVE-2025-43300CRITICALbajo ataque30 sep 2025

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 1

90RIESGO

abrir ↗

GitHub PoC★ 1

A Rust implementation of the POC for CVE-2017-7269, targeting the WebDAV service in Microsoft Internet Information Services (IIS) 6.0.

CVE-2017-7269CRITICALbajo ataque30 sep 2025

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in

100RIESGO

abrir ↗

GitHub PoC

tno01/cve-2019-3396

CVE-2019-3396CRITICALbajo ataqueransomware30 sep 2025

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from vers

100RIESGO

abrir ↗

GitHub PoC★ 1

Detection for CVE-2025-41244

CVE-2025-41244HIGHbajo ataque30 sep 2025

VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)

71RIESGO

abrir ↗

GitHub PoC

Tnot123/cve-2017-9822

CVE-2017-9822HIGHbajo ataqueransomware30 sep 2025

DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code e

100RIESGO

abrir ↗

GitHub PoC

A Python exploit for CVE-2025-32463, a critical local privilege escalation vulnerability in the Sudo binary on Linux systems. This flaw allows local users to obtain root access by exploiting the --chroot option, which incorrectly uses /etc/nsswitch.conf from a user-controlled directory.

CVE-2025-32463CRITICALbajo ataque30 sep 2025

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RIESGO

abrir ↗

GitHub PoC

Log4Shell (CVE-2021-44228) PoC

CVE-2021-44228CRITICALbajo ataqueransomware29 sep 2025

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC

victormbogu1/LetsDefend-SOC342-CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-andRCE-EventID-320

CVE-2025-53770CRITICALbajo ataqueransomware29 sep 2025

Microsoft SharePoint Server Remote Code Execution Vulnerability

100RIESGO

abrir ↗

GitHub PoC

CVE-2024-47051

CVE-2024-47051CRITICAL29 sep 2025

Remote Code Execution & File Deletion in Asset Uploads

48RIESGO

abrir ↗

GitHub PoC

kuyrathdaro/cve-2025-29927

CVE-2025-29927CRITICAL28 sep 2025

Authorization Bypass in Next.js Middleware

85RIESGO

abrir ↗

GitHub PoC

ethan-repo-lab4b6/CVE-2022-36537

CVE-2022-36537HIGHbajo ataqueransomware28 sep 2025

ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafte

100RIESGO

abrir ↗

GitHub PoC

0xDTC/CrushFTP-auth-bypass-CVE-2025-31161

CVE-2025-31161CRITICALbajo ataqueransomware27 sep 2025

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle

100RIESGO

abrir ↗

GitHub PoC

CVE-2025-10035_GoAnywhere Get RCE

CVE-2025-10035CRITICALbajo ataqueransomware27 sep 2025

Deserialization Vulnerability in GoAnywhere MFT's License Servlet

100RIESGO

abrir ↗

GitHub PoC

A Rust implementation of the POC for the CVE-2009-2265 exploit, targeting Adobe ColdFusion 8.

CVE-2009-2265—27 sep 2025

Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable fil

60RIESGO

abrir ↗

GitHub PoC

This repository documents how deployment of Microsoft Defender for Endpoint on a Windows 11 device, including onboarding via local script, enabling device discovery, configuring Log4j2 detection (CVE-2021-44228), and validating incident response workflows.

CVE-2021-44228CRITICALbajo ataqueransomware27 sep 2025

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC

Analyzing CVE-2023-36802 (mskssrv.sys) - object type confusion bug

CVE-2023-36802HIGHbajo ataque26 sep 2025

Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability

76RIESGO

abrir ↗

GitHub PoC

Scans target to see if its vulnerable to CVE-2025-31161

CVE-2025-31161CRITICALbajo ataqueransomware26 sep 2025

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle

100RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2024-6387 and more Checker and Exploiter - Reverse/Bind-Shell Support. education only

CVE-2024-6387HIGH26 sep 2025

Openssh: regresshion - race condition in ssh allows rce/dos

63RIESGO

abrir ↗

GitHub PoC

Example script demonstrating a weak PRNG, CVE-2008-0166

CVE-2008-0166—25 sep 2025

OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that ge

45RIESGO

abrir ↗

GitHub PoC★ 8

CVE-2025-8088 exploit C++ impl

CVE-2025-8088HIGHbajo ataqueransomware25 sep 2025

Path traversal vulnerability in WinRAR

93RIESGO

abrir ↗

GitHub PoC

CVE-2017-5638- PoC

CVE-2017-5638CRITICALbajo ataqueransomware25 sep 2025

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

100RIESGO

abrir ↗

GitHub PoC★ 1

JS Archive List <= 6.1.5 - Unauthenticated SQL Injection

CVE-2025-54726CRITICAL25 sep 2025

WordPress JS Archive List Plugin < 6.1.6 - SQL Injection Vulnerability

63RIESGO

abrir ↗

GitHub PoC★ 6

CVE-2025-20352 SNMP Exposure Check (onesixtyone + parser)

CVE-2025-20352HIGHbajo ataque25 sep 2025

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Softwa

83RIESGO

abrir ↗

GitHub PoC

Microsoft HEIF Extension (msheif_store.dll) OOB-read

CVE-2025-62821CRITICAL25 sep 2025

Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return suc

48RIESGO

abrir ↗

GitHub PoC

CVE-2025-49132

CVE-2025-49132CRITICAL25 sep 2025

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

75RIESGO

abrir ↗

GitHub PoC

CVE-2025-49132

CVE-2025-49132CRITICAL25 sep 2025

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

75RIESGO

abrir ↗

GitHub PoC

This repository contains a Proof of Concept (PoC) for CVE-2025-32463, a vulnerability in sudo allowing a chroot escape to achieve local privilege escalation.

CVE-2025-32463CRITICALbajo ataque24 sep 2025

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.