Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.883exploits catalogados

40.037CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 25.956Exploit-DB 24.488GitHub PoC 17.453VulnCheck XDB 9931Nuclei 4527Metasploit 3528✓ solo verificadosrecientes populares riesgo

17.453 exploits

GitHub PoC

a1ex-var1amov/ctf-cve-2019-11043

CVE-2019-11043HIGHbajo ataqueransomware26 ago 2025

Underflow in PHP-FPM can lead to RCE

100RIESGO

abrir ↗

GitHub PoC

A critical remote code execution (RCE) vulnerability (CVE‑2025‑24893) exists in the XWiki Platform, specifically in the SolrSearch RSS feed endpoint.

CVE-2025-24893CRITICALbajo ataque26 ago 2025

Remote code execution as guest via SolrSearchMacros request in xwiki

100RIESGO

abrir ↗

GitHub PoC

TamatahYT/CVE-2017-8481

CVE-2017-8481—25 ago 2025

The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,

23RIESGO

abrir ↗

GitHub PoC★ 11

zenzue/CVE-2025-9074

CVE-2025-9074CRITICAL25 ago 2025

Docker Desktop allows unauthenticated access to Docker Engine API from containers

48RIESGO

abrir ↗

GitHub PoC

A research regarding the exisiting CVE exploit : CVE-2021-3156(Sudo BufferOverflow)

CVE-2021-3156HIGHbajo ataque25 ago 2025

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RIESGO

abrir ↗

GitHub PoC★ 3

Apache Struts2 CVE-2017-5638 (Safe Educational Demo)

CVE-2017-5638CRITICALbajo ataqueransomware25 ago 2025

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

100RIESGO

abrir ↗

GitHub PoC

his project demonstrates the exploitation of the vsFTPd 2.3.4 backdoor vulnerability (CVE-2011-2523) using Metasploitable 2 and Kali Linux with Metasploit. It includes reconnaissance, exploitation, and defensive measures, with a detailed report and lab setup for learning ethical hacking and security best practices.

CVE-2011-2523—25 ago 2025

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

abrir ↗

GitHub PoC

PoC

CVE-2025-48384HIGHbajo ataque25 ago 2025

Git allows arbitrary code execution through broken config quoting

71RIESGO

abrir ↗

GitHub PoC

a1ex-var1amov/ctf-cve-2024-4577

CVE-2024-4577CRITICALbajo ataqueransomware25 ago 2025

Argument Injection in PHP-CGI

100RIESGO

abrir ↗

GitHub PoC★ 95

mistymntncop/CVE-2025-5419

CVE-2025-5419HIGHbajo ataque25 ago 2025

Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially expl

71RIESGO

abrir ↗

GitHub PoC★ 28

watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309

CVE-2025-54309CRITICALbajo ataque25 ago 2025

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and

100RIESGO

abrir ↗

GitHub PoC★ 2

Odoo ≤17 is vulnerable to CVE-2024-4367, allowing arbitrary JavaScript execution via PDF.js.

CVE-2024-4367MEDIUM25 ago 2025

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c

55RIESGO

abrir ↗

GitHub PoC★ 114

This is POC for IOS 0click CVE-2025-43300

CVE-2025-43300CRITICALbajo ataque24 ago 2025

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 1

90RIESGO

abrir ↗

GitHub PoC★ 5

POC of CVE-2025-49113

CVE-2025-49113CRITICALbajo ataque24 ago 2025

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the

100RIESGO

abrir ↗

GitHub PoC

Quick and easy exploitation of CVE-2024-4956 for LFI.

CVE-2024-4956HIGH24 ago 2025

Nexus Repository 3 - Path Traversal

61RIESGO

abrir ↗

GitHub PoC★ 42

Glass Cage is a zero-click PNG-based RCE chain in iOS 18.2.1, bypassing LockDown mode protection by exploiting ImageIO (CVE-2025-43300), then WebKit(CVE-2025-24201) and Core Media(CVE-2025-24085) to achieve sandbox escape, kernel-level access, and device bricking. Triggered via iMessage, it enables full compromise with no user interaction.

CVE-2025-24085CRITICALbajo ataque23 ago 2025

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, i

83RIESGO

abrir ↗

GitHub PoC★ 1

POC exploit for CVE-2025-33053 (external control of file execution path in URL file)

CVE-2025-33053HIGHbajo ataque23 ago 2025

Internet Shortcut Files Remote Code Execution Vulnerability

100RIESGO

abrir ↗

GitHub PoC★ 1

Este repositório contém um script de prova de conceito (PoC) que demonstra uma vulnerabilidade crítica encontrada no plugin Simple File List para WordPress.

CVE-2020-36847CRITICAL23 ago 2025

Simple File List < 4.2.3 - Remote Code Execution

75RIESGO

abrir ↗

GitHub PoC

２０２５年８月２０日に公開されたDockerDesktopの脆弱性(対策済み)を実証する

CVE-2025-9074CRITICAL23 ago 2025

Docker Desktop allows unauthenticated access to Docker Engine API from containers

48RIESGO

abrir ↗

GitHub PoC

Sequelize Sql Injection 취약점 구현

CVE-2023-25813CRITICAL23 ago 2025

SQL Injection via replacements in sequelize

48RIESGO

abrir ↗

GitHub PoC

A PHP CGI Vulnerability Scanner for CVE-2024-4577

CVE-2024-4577CRITICALbajo ataqueransomware23 ago 2025

Argument Injection in PHP-CGI

100RIESGO

abrir ↗

GitHub PoC

donmedfor/CVE-2015-3306

CVE-2015-3306CRITICALbajo ataque23 ago 2025

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and

100RIESGO

abrir ↗

GitHub PoC

Explotación vulnerabilidad Dirty COW (CVE-2016-5195) en Ubuntu 16.04.1.

CVE-2016-5195HIGHbajo ataque22 ago 2025

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RIESGO

abrir ↗

GitHub PoC

The exploit code for CVE-2025-43300.

CVE-2025-43300CRITICALbajo ataque22 ago 2025

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 1

90RIESGO

abrir ↗

GitHub PoC★ 1

Fix for undefined method each in Metasploit’s bailiwicked_domain.rb (CVE-2008-1447 DNS cache poisoning module)

CVE-2008-1447—22 ago 2025

The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windo

60RIESGO

abrir ↗

GitHub PoC★ 2

PoC exploit for Below privilege escalation (CVE-2025-27591) allowing local root access via symlink manipulation in world-writable log directory.

CVE-2025-27519CRITICAL22 ago 2025

Cognita Arbitrary File Write

48RIESGO

abrir ↗

GitHub PoC

Telerik CVE-2019-18935 Vulnerability Scanner

CVE-2019-18935CRITICALbajo ataqueransomware22 ago 2025

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUp

100RIESGO

abrir ↗

GitHub PoC★ 1

Some poorly crafted exploit scripts

CVE-2025-24893CRITICALbajo ataque22 ago 2025

Remote code execution as guest via SolrSearchMacros request in xwiki

100RIESGO

abrir ↗

GitHub PoC★ 1

Kryptoenix/CVE-2025-47987_PoC

CVE-2025-47987HIGH22 ago 2025

Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability

41RIESGO

abrir ↗

GitHub PoC

0xr2r/CVE-2024-4367

CVE-2024-4367MEDIUM22 ago 2025

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c

55RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.