Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
81.192exploits catalogados
37.765CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.482Referência 24.138GitHub PoC 15.542VulnCheck XDB 9091Nuclei 4434Metasploit 3505✓ solo verificadosrecientespopularesriesgo
81.059 exploits
GitHub PoC★ 7
Playground to experiment with different behavior on patched/unpatched Kestrel for the CVE-2025-55315 HTTP smuggling vulnerability
ASP.NET Security Feature Bypass Vulnerability
60RIESGO
abrir ↗GitHub PoC★ 13
Proof of concept for CVE-2022-1364 against Alibaba's UC Browser
Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit
76RIESGO
abrir ↗GitHub PoC
PoC of CVE-2025-60751
GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode.
41RIESGO
abrir ↗GitHub PoC★ 1
The default configuration of LDAP on FortiOS v6.0.x to v6.2.0 does not check server identity for LDAP/S leading to MITM attacks. This PoC demos full exfiltration of credentials sent on the local subnet to an LDAP server that is easily impersonated.
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept s
83RIESGO
abrir ↗VulnCheck XDB
initial-access
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RIESGO
abrir ↗VulnCheck XDB
local
7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability
46RIESGO
abrir ↗GitHub PoC★ 1
This repo shows an exploit to CVE-2021-24762. This is an Blind SQLi exploit that, on default config, greps the admin password.
Perfect Survey < 1.5.2 - Unauthenticated SQL Injection
60RIESGO
abrir ↗GitHub PoC
Una CTF, in formato DSP-compliant, basata sulla CVE-2025-29927 di nextjs.
Authorization Bypass in Next.js Middleware
85RIESGO
abrir ↗GitHub PoC★ 151
Exploit for CVE-2025-11001 or CVE-2025-11002
7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability
46RIESGO
abrir ↗GitHub PoC
CVE-2024-53677 관련 컨설턴트용 툴 개발
Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
70RIESGO
abrir ↗VulnCheck XDB
initial-access
Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
70RIESGO
abrir ↗GitHub PoC
Oracle WebLogic WLS-WSAT Remote Code Execution Exploit (CVE-2017-10271)
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RIESGO
abrir ↗GitHub PoC★ 11
BYOVD research performed by KOSEC. Includes vulnerable drivers and writeups (CVE-2026-0828).
Kernel driver vulnerability in Safetica Endpoint Client
41RIESGO
abrir ↗VulnCheck XDB
initial-access
Remote code execution as guest via SolrSearchMacros request in xwiki
100RIESGO
abrir ↗GitHub PoC
CVE-2025-4123 Grafana Open Redirect Exploit
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
78RIESGO
abrir ↗VulnCheck XDB
client-side
Git allows arbitrary code execution through broken config quoting
71RIESGO
abrir ↗VulnCheck XDB
client-side
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
78RIESGO
abrir ↗VulnCheck XDB
initial-access
StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload
75RIESGO
abrir ↗GitHub PoC★ 3
StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload
StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload
75RIESGO
abrir ↗Metasploit500
Windows Server Update Service Deserialization Remote Code Execution
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
100RIESGO
abrir ↗GitHub PoC★ 19
PoC for CVE-2025-25198: automated Host header poisoning test for Mailcow - HTTPS listener, automatic cookie/CSRF handling, captures first reset link.
mailcow: dockerized vulnerable to password reset poisoning
41RIESGO
abrir ↗GitHub PoC
Captures password reset tokens from Mailcow Host header injection attacks.
mailcow: dockerized vulnerable to password reset poisoning
41RIESGO
abrir ↗GitHub PoC
CVE-2025-24893 tool
Remote code execution as guest via SolrSearchMacros request in xwiki
100RIESGO
abrir ↗VulnCheck XDB
local
7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability
46RIESGO
abrir ↗GitHub PoC★ 4
A scanner and testter of the CVE-2025-11001 of 7-zip
7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability
46RIESGO
abrir ↗VulnCheck XDB
client-side
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write v
76RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.