Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

75.902exploits catalogados

34.597CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.443Referência 21.624GitHub PoC 13.727VulnCheck XDB 8410Nuclei 4231Metasploit 3467✓ solo verificadosrecientes populares riesgo

75.902 exploits

GitHub PoC

The goal of this project was to conduct a security audit of a blog recently launched by Ackme Support Incorporated, identifying any critical vulnerabilities before the site goes public. The task involved finding a way to remotely execute code and gain access to the target system.

CVE-2018-16763—13 abr 2025

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca

60RIESGO

GitHub PoC

Exploit de la vulneravilidad CVE-2021-4034

CVE-2021-4034HIGHbajo ataque13 abr 2025

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RIESGO

GitHub PoC

spyata123/CVE-2023-3128

CVE-2023-3128CRITICAL13 abr 2025

Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique a

48RIESGO

GitHub PoC★ 35

mistymntncop/CVE-2024-7971

CVE-2024-7971HIGHbajo ataque12 abr 2025

Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a

76RIESGO

GitHub PoC★ 1

PHP CGI CVE-2024-4577 PoC

CVE-2024-4577CRITICALbajo ataqueransomware12 abr 2025

Argument Injection in PHP-CGI

100RIESGO

Metasploit600

Web-Check Screenshot API Command Injection RCE

CVE-2025-32778CRITICAL12 abr 2025

Web-Check allows command Injection via Unvalidated URL in Screenshot API

68RIESGO

GitHub PoC

ReFlex Gallery (WordPress plugin) =< 3.1.3 CVE-2015-4133 PoC

CVE-2015-4133—12 abr 2025

Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 f

50RIESGO

GitHub PoC

PoC of CVE-2023-1177 vulnerability in MLflow (Reproduce)

CVE-2023-1177CRITICAL12 abr 2025

Path Traversal: '\..\filename' in mlflow/mlflow

75RIESGO

VulnCheck XDB

infoleak

CVE-2024-36991HIGH12 abr 2025

Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows

61RIESGO

GitHub PoC

PDF host for CVE-2024-4367

CVE-2024-4367MEDIUM12 abr 2025

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c

55RIESGO

VulnCheck XDB

client-side

CVE-2024-7971HIGHbajo ataque12 abr 2025

Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a

76RIESGO

VulnCheck XDB

infoleak

CVE-2014-0160HIGHbajo ataque12 abr 2025

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

VulnCheck XDB

initial-access

CVE-2024-4577CRITICALbajo ataqueransomware12 abr 2025

Argument Injection in PHP-CGI

100RIESGO

GitHub PoC

vsFTPd 2.3.4 CVE-2011-2523 PoC

CVE-2011-2523—12 abr 2025

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

VulnCheck XDB

initial-access

CVE-2025-3102HIGH12 abr 2025

SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation

78RIESGO

VulnCheck XDB

infoleak

CVE-2023-1177CRITICAL12 abr 2025

Path Traversal: '\..\filename' in mlflow/mlflow

75RIESGO

VulnCheck XDB

initial-access

CVE-2025-24813CRITICALbajo ataque12 abr 2025

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RIESGO

VulnCheck XDB

initial-access

CVE-2025-24813CRITICALbajo ataque12 abr 2025

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RIESGO

VulnCheck XDB

initial-access

CVE-2023-28121—12 abr 2025

An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to s

60RIESGO

GitHub PoC

nicoleman0/CVE-2016-6210-OpenSSHd-7.2p2

CVE-2016-6210MEDIUM12 abr 2025

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static

70RIESGO

GitHub PoC★ 5

CVE-2025-24813-Scanner is a Python-based vulnerability scanner that detects Apache Tomcat servers vulnerable to CVE-2025-24813, an arbitrary file upload vulnerability leading to remote code execution (RCE) via insecure PUT method handling and jsessionid exploitation.

CVE-2025-24813CRITICALbajo ataque12 abr 2025

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RIESGO

GitHub PoC

This is the Heratbleed bug (CVE-2014-0160) documentation I did for Advenced Cyber Attacks course.

CVE-2014-0160HIGHbajo ataque12 abr 2025

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC★ 3

A Python proof-of-concept exploit for CVE-2025-24813 - Unauthenticated RCE in Apache Tomcat (v9.0.0-9.0.98/10.1.0-10.1.34/11.0.0-11.0.2) via malicious Java object deserialization. Includes safe detection mode and custom payload support.

CVE-2025-24813CRITICALbajo ataque12 abr 2025

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RIESGO

Exploit-DB

GeoVision GV-ASManager 6.1.1.0 - CSRF

CVE-2024-56901HIGHwebappsmultiple11 abr 2025

A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less tha

41RIESGO

Exploit-DB

MagnusSolution magnusbilling 7.3.0 - Command Injection

CVE-2023-30258CRITICALwebappsmultiple11 abr 2025

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary com

85RIESGO

Exploit-DB

qBittorrent 5.0.1 - MITM RCE

CVE-2024-51774HIGHlocalmultiple11 abr 2025

qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors.

41RIESGO

Exploit-DB

GeoVision GV-ASManager 6.1.0.0 - Broken Access Control

CVE-2024-56898HIGHwebappsmultiple11 abr 2025

Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less. This vulnerability allows low p

41RIESGO

Exploit-DB

Gnuboard5 5.3.2.8 - SQL Injection

CVE-2020-18662—webappsphp11 abr 2025

SQL Injection vulnerability in gnuboard5 <=v5.3.2.8 via the table_prefix parameter in install_db.php.

23RIESGO

GitHub PoC

ngyinkit/cve-2019-18634

CVE-2019-18634—11 abr 2025

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the

28RIESGO

GitHub PoC★ 1

A Python proof-of-concept exploit for CVE-2019-15107 - an unauthenticated remote code execution vulnerability in Webmin versions 1.890 through 1.920.

CVE-2019-15107CRITICALbajo ataqueransomware11 abr 2025

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.